d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Limit option_len for the TCP_CCALGOOPT.

Browse Source 
Limiting the length to 2048 bytes seems to be acceptable, since
the values used right now are using 8 bytes.

Reviewed by:		glebius, bz, rrs
MFC after:		3 days
Sponsored by:		Netflix, Inc.
Differential Revision:	https://reviews.freebsd.org/D18366
This commit is contained in:
Michael Tuexen 2018-11-30 10:50:07 +00:00
parent 851073551d
commit c8b53ced95
2 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/netinet/cc/cc.h
View File

@ -184,4 +184,6 @@ extern struct rwlock cc_list_lock;
#define CC_LIST_WUNLOCK() rw_wunlock(&cc_list_lock)
#define CC_LIST_LOCK_ASSERT() rw_assert(&cc_list_lock, RA_LOCKED)
#define CC_ALGOOPT_LIMIT 2048
#endif /* _NETINET_CC_CC_H_ */

2
sys/netinet/tcp_usrreq.c
View File

@ -1769,6 +1769,8 @@ tcp_default_ctloutput(struct socket *so, struct sockopt *sopt, struct inpcb *inp
switch (sopt->sopt_name) {
case TCP_CCALGOOPT:
INP_WUNLOCK(inp);
if (sopt->sopt_valsize > CC_ALGOOPT_LIMIT)
return (EINVAL);
pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK | M_ZERO);
error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,
sopt->sopt_valsize);