lkml.org 
[lkml]   [2017]   [Nov]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.4 11/17] net: sctp: fix array overrun read on sctp_timer_tbl
    Date
    From: Colin Ian King <colin.king@canonical.com>

    [ Upstream commit 0e73fc9a56f22f2eec4d2b2910c649f7af67b74d ]

    The comparison on the timeout can lead to an array overrun
    read on sctp_timer_tbl because of an off-by-one error. Fix
    this by using < instead of <= and also compare to the array
    size rather than SCTP_EVENT_TIMEOUT_MAX.

    Fixes CoverityScan CID#1397639 ("Out-of-bounds read")

    Signed-off-by: Colin Ian King <colin.king@canonical.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
    ---
    net/sctp/debug.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/net/sctp/debug.c b/net/sctp/debug.c
    index 95d7b15dad21..e371a0d90068 100644
    --- a/net/sctp/debug.c
    +++ b/net/sctp/debug.c
    @@ -166,7 +166,7 @@ static const char *const sctp_timer_tbl[] = {
    /* Lookup timer debug name. */
    const char *sctp_tname(const sctp_subtype_t id)
    {
    - if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX)
    + if (id.timeout < ARRAY_SIZE(sctp_timer_tbl))
    return sctp_timer_tbl[id.timeout];
    return "unknown_timer";
    }
    --
    2.11.0
    \
     
     \ /
      Last update: 2017-11-23 00:07    [W:3.961 / U:0.108 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site