lkml.org 
[lkml]   [2011]   [Oct]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[24/27] x25: Prevent skb overreads when checking call user data
    3.0-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Matthew Daley <mattjd@gmail.com>

    commit 7f81e25befdfb3272345a2e775f520e1d515fa20 upstream.

    x25_find_listener does not check that the amount of call user data given
    in the skb is big enough in per-socket comparisons, hence buffer
    overreads may occur. Fix this by adding a check.

    Signed-off-by: Matthew Daley <mattjd@gmail.com>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Cc: Andrew Hendry <andrew.hendry@gmail.com>
    Acked-by: Andrew Hendry <andrew.hendry@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    net/x25/af_x25.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/net/x25/af_x25.c
    +++ b/net/x25/af_x25.c
    @@ -295,7 +295,8 @@ static struct sock *x25_find_listener(st
    * Found a listening socket, now check the incoming
    * call user data vs this sockets call user data
    */
    - if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
    + if (x25_sk(s)->cudmatchlength > 0 &&
    + skb->len >= x25_sk(s)->cudmatchlength) {
    if((memcmp(x25_sk(s)->calluserdata.cuddata,
    skb->data,
    x25_sk(s)->cudmatchlength)) == 0) {



    \
     
     \ /
      Last update: 2011-10-23 08:37    [W:0.021 / U:93.660 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site