d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve input validation for some parameters having a too small

Browse Source 
reported length.

Thanks to Natalie Silvanovich from Google for finding one of these
issues in the SCTP userland stack and reporting it.

MFC after:		1 week
This commit is contained in:
Michael Tuexen 2019-12-20 15:25:08 +00:00
parent 548dca90ae
commit 6088175a18
2 changed files with 6 additions and 2 deletions

3
sys/netinet/sctp_auth.c

@ -1397,7 +1397,8 @@ sctp_auth_get_cookie_params(struct sctp_tcb *stcb, struct mbuf *m,
ptype = ntohs(phdr->param_type);
plen = ntohs(phdr->param_length);
if ((plen == 0) || (offset + plen > length))
if ((plen < sizeof(struct sctp_paramhdr)) ||
(offset + plen > length))
break;
if (ptype == SCTP_RANDOM) {

5
sys/netinet/sctp_pcb.c

@ -6202,7 +6202,7 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
if (offset + plen > limit) {
break;
}
if (plen == 0) {
if (plen < sizeof(struct sctp_paramhdr)) {
break;
}
#ifdef INET
@ -6428,6 +6428,9 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
if (plen > sizeof(lstore)) {
return (-23);
}
if (plen < sizeof(struct sctp_asconf_addrv4_param)) {
return (-101);
}
phdr = sctp_get_next_param(m, offset,
(struct sctp_paramhdr *)&lstore,
plen);