Messages in this thread Patch in this message | | | Date | Mon, 23 Jun 2008 16:05:28 -0700 | From | Greg KH <> | Subject | [patch 03/10] sctp: Make sure N * sizeof(union sctp_addr) does not overflow. |
| |
2.6.25.9-stable review patch. If anyone has any objections, please let us know.
------------------ From: David S. Miller <davem@davemloft.net>
commit 735ce972fbc8a65fb17788debd7bbe7b4383cc62 upstream
As noticed by Gabriel Campana, the kmalloc() length arg passed in by sctp_getsockopt_local_addrs_old() can overflow if ->addr_num is large enough.
Therefore, enforce an appropriate limit.
Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- net/sctp/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -4421,7 +4421,9 @@ static int sctp_getsockopt_local_addrs_o if (copy_from_user(&getaddrs, optval, len)) return -EFAULT; - if (getaddrs.addr_num <= 0) return -EINVAL; + if (getaddrs.addr_num <= 0 || + getaddrs.addr_num >= (INT_MAX / sizeof(union sctp_addr))) + return -EINVAL; /* * For UDP-style sockets, id specifies the association to query. * If the id field is set to the value '0' then the locally bound --
| |