Check the length of a COOKIE chunk before accessing fields in it.
Thanks to Felix Weinrank for reporting the issue he found by using libFuzzer. MFC after: 3 days
This commit is contained in:
parent
1a7abbb3be
commit
d44b45df2c
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=320264
@ -2441,6 +2441,12 @@ sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
|
||||
cookie_offset = offset + sizeof(struct sctp_chunkhdr);
|
||||
cookie_len = ntohs(cp->ch.chunk_length);
|
||||
|
||||
if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
|
||||
sizeof(struct sctp_init_chunk) +
|
||||
sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
|
||||
/* cookie too small */
|
||||
return (NULL);
|
||||
}
|
||||
if ((cookie->peerport != sh->src_port) ||
|
||||
(cookie->myport != sh->dest_port) ||
|
||||
(cookie->my_vtag != sh->v_tag)) {
|
||||
@ -2453,12 +2459,6 @@ sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
|
||||
*/
|
||||
return (NULL);
|
||||
}
|
||||
if (cookie_len < sizeof(struct sctp_cookie_echo_chunk) +
|
||||
sizeof(struct sctp_init_chunk) +
|
||||
sizeof(struct sctp_init_ack_chunk) + SCTP_SIGNATURE_SIZE) {
|
||||
/* cookie too small */
|
||||
return (NULL);
|
||||
}
|
||||
/*
|
||||
* split off the signature into its own mbuf (since it should not be
|
||||
* calculated in the sctp_hmac_m() call).
|
||||
|
Loading…
Reference in New Issue
Block a user