sctp: fix random memory dereference with SCTP_HMAC_IDENT option.

The number of identifiers needs to be checked against the option
length.  Also, the identifier index provided needs to be verified
to make sure that it doesn't exceed the bounds of the array.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Vlad Yasevich 2008-08-27 16:09:49 -07:00 committed by David S. Miller
parent 328fc47ea0
commit d97240552c
2 changed files with 7 additions and 2 deletions

View file

@ -786,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
for (i = 0; i < hmacs->shmac_num_idents; i++) { for (i = 0; i < hmacs->shmac_num_idents; i++) {
id = hmacs->shmac_idents[i]; id = hmacs->shmac_idents[i];
if (id > SCTP_AUTH_HMAC_ID_MAX)
return -EOPNOTSUPP;
if (SCTP_AUTH_HMAC_ID_SHA1 == id) if (SCTP_AUTH_HMAC_ID_SHA1 == id)
has_sha1 = 1; has_sha1 = 1;

View file

@ -3086,6 +3086,7 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
int optlen) int optlen)
{ {
struct sctp_hmacalgo *hmacs; struct sctp_hmacalgo *hmacs;
u32 idents;
int err; int err;
if (!sctp_auth_enable) if (!sctp_auth_enable)
@ -3103,8 +3104,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
goto out; goto out;
} }
if (hmacs->shmac_num_idents == 0 || idents = hmacs->shmac_num_idents;
hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) { if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
(idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
err = -EINVAL; err = -EINVAL;
goto out; goto out;
} }