Add missing input validation. This could result in reading from
uninitialized memory. The issue was found by OSS-Fuzz for usrsctp and reported in https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17780 MFC after: 3 days
This commit is contained in:
parent
fbf0f3106c
commit
967e1a5333
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=353060
@ -169,10 +169,16 @@ sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *ap
|
||||
#endif
|
||||
|
||||
aparam_length = ntohs(aph->ph.param_length);
|
||||
if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
|
||||
return (NULL);
|
||||
}
|
||||
ph = (struct sctp_paramhdr *)(aph + 1);
|
||||
param_type = ntohs(ph->param_type);
|
||||
#if defined(INET) || defined(INET6)
|
||||
param_length = ntohs(ph->param_length);
|
||||
if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
|
||||
return (NULL);
|
||||
}
|
||||
#endif
|
||||
sa = &store.sa;
|
||||
switch (param_type) {
|
||||
@ -325,8 +331,14 @@ sctp_process_asconf_delete_ip(struct sockaddr *src,
|
||||
aparam_length = ntohs(aph->ph.param_length);
|
||||
ph = (struct sctp_paramhdr *)(aph + 1);
|
||||
param_type = ntohs(ph->param_type);
|
||||
if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
|
||||
return (NULL);
|
||||
}
|
||||
#if defined(INET) || defined(INET6)
|
||||
param_length = ntohs(ph->param_length);
|
||||
if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
|
||||
return (NULL);
|
||||
}
|
||||
#endif
|
||||
sa = &store.sa;
|
||||
switch (param_type) {
|
||||
@ -454,10 +466,16 @@ sctp_process_asconf_set_primary(struct sockaddr *src,
|
||||
#endif
|
||||
|
||||
aparam_length = ntohs(aph->ph.param_length);
|
||||
if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
|
||||
return (NULL);
|
||||
}
|
||||
ph = (struct sctp_paramhdr *)(aph + 1);
|
||||
param_type = ntohs(ph->param_type);
|
||||
#if defined(INET) || defined(INET6)
|
||||
param_length = ntohs(ph->param_length);
|
||||
if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
|
||||
return (NULL);
|
||||
}
|
||||
#endif
|
||||
sa = &store.sa;
|
||||
switch (param_type) {
|
||||
|
Loading…
Reference in New Issue
Block a user