From: Vladislav Yasevich Date: Fri, 19 May 2006 21:25:53 +0000 (-0700) Subject: [SCTP]: Validate the parameter length in HB-ACK chunk. X-Git-Tag: v2.6.17-rc5~91^2~1 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a601266e4f3c479790f373c2e3122a766d123652;p=linux-2.6 [SCTP]: Validate the parameter length in HB-ACK chunk. If SCTP receives a badly formatted HB-ACK chunk, it is possible that we may access invalid memory and potentially have a buffer overflow. We should really make sure that the chunk format is what we expect, before attempting to touch the data. Signed-off-by: Vlad Yasevich Signed-off-by: Sridhar Samudrala --- diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 174f7a7c6c..8bc279219a 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -1019,6 +1019,12 @@ sctp_disposition_t sctp_sf_backbeat_8_3(const struct sctp_endpoint *ep, commands); hbinfo = (sctp_sender_hb_info_t *) chunk->skb->data; + /* Make sure that the length of the parameter is what we expect */ + if (ntohs(hbinfo->param_hdr.length) != + sizeof(sctp_sender_hb_info_t)) { + return SCTP_DISPOSITION_DISCARD; + } + from_addr = hbinfo->daddr; link = sctp_assoc_lookup_paddr(asoc, &from_addr);