d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add missing input validation. This could result in reading from

Browse Source 
uninitialized memory.
The issue was found by OSS-Fuzz for usrsctp  and reported in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17780

MFC after:		3 days
This commit is contained in:
Michael Tuexen 2019-10-03 18:36:54 +00:00
parent fbf0f3106c
commit 967e1a5333
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
sys/netinet/sctp_asconf.c
View File

@ -169,10 +169,16 @@ sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *ap
#endif
aparam_length = ntohs(aph->ph.param_length);
if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
return (NULL);
}
ph = (struct sctp_paramhdr *)(aph + 1);
param_type = ntohs(ph->param_type);
#if defined(INET) || defined(INET6)
param_length = ntohs(ph->param_length);
if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
return (NULL);
}
#endif
sa = &store.sa;
switch (param_type) {
@ -325,8 +331,14 @@ sctp_process_asconf_delete_ip(struct sockaddr *src,
aparam_length = ntohs(aph->ph.param_length);
ph = (struct sctp_paramhdr *)(aph + 1);
param_type = ntohs(ph->param_type);
if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
return (NULL);
}
#if defined(INET) || defined(INET6)
param_length = ntohs(ph->param_length);
if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
return (NULL);
}
#endif
sa = &store.sa;
switch (param_type) {
@ -454,10 +466,16 @@ sctp_process_asconf_set_primary(struct sockaddr *src,
#endif
aparam_length = ntohs(aph->ph.param_length);
if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
return (NULL);
}
ph = (struct sctp_paramhdr *)(aph + 1);
param_type = ntohs(ph->param_type);
#if defined(INET) || defined(INET6)
param_length = ntohs(ph->param_length);
if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
return (NULL);
}
#endif
sa = &store.sa;
switch (param_type) {