linux/net/sctp
Dan Rosenberg 51e97a12be sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac()
The sctp_asoc_get_hmac() function iterates through a peer's hmac_ids
array and attempts to ensure that only a supported hmac entry is
returned.  The current code fails to do this properly - if the last id
in the array is out of range (greater than SCTP_AUTH_HMAC_ID_MAX), the
id integer remains set after exiting the loop, and the address of an
out-of-bounds entry will be returned and subsequently used in the parent
function, causing potentially ugly memory corruption.  This patch resets
the id integer to 0 on encountering an invalid id so that NULL will be
returned after finishing the loop if no valid ids are found.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2010-10-03 21:58:49 -07:00
..
associola.c fix typos concerning "initiali[zs]e" 2010-06-16 18:05:05 +02:00
auth.c sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac() 2010-10-03 21:58:49 -07:00
bind_addr.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
chunk.c sctp: Tag messages that can be Nagle delayed at creation. 2010-04-30 22:41:10 -04:00
command.c [SCTP]: Remove sctp_add_cmd_sf wrapper bloat 2008-03-27 17:54:29 -07:00
debug.c net: mark read-only arrays as const 2009-08-05 10:42:58 -07:00
endpointola.c Merge branch 'net-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vxy/lksctp-dev 2010-05-03 16:24:31 -07:00
input.c sctp: Fix a race between ICMP protocol unreachable and connect() 2010-05-06 00:56:07 -07:00
inqueue.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
ipv6.c net: replace ipfragok with skb->local_df 2010-04-15 23:36:37 -07:00
Kconfig sctp: implement sctp association probing module 2010-04-30 22:41:09 -04:00
Makefile sctp: implement sctp association probing module 2010-04-30 22:41:09 -04:00
objcnt.c [NET]: Fix heavy stack usage in seq_file output routines. 2008-04-24 01:02:16 -07:00
output.c sctp: Do not reset the packet during sctp_packet_config(). 2010-09-17 16:47:56 -07:00
outqueue.c net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
primitive.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
probe.c Merge branch 'net-next' of git://git.kernel.org/pub/scm/linux/kernel/git/vxy/lksctp-dev 2010-05-03 16:24:31 -07:00
proc.c net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
protocol.c Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2010-08-04 15:31:02 -07:00
sm_make_chunk.c net: use __packed annotation 2010-06-03 03:21:52 -07:00
sm_sideeffect.c net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00
sm_statefuns.c sctp: fix test for end of loop 2010-09-09 15:00:29 -07:00
sm_statetable.c sctp: fix a typo in net/sctp/sm_statetable.c 2009-06-03 09:14:45 -04:00
socket.c sctp: prevent reading out-of-bounds memory 2010-10-03 21:58:48 -07:00
ssnmap.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
sysctl.c sctp: fix compile error due to sysctl mismerge 2009-12-08 12:51:22 -08:00
transport.c Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6 2010-05-16 22:26:58 -07:00
tsnmap.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
ulpevent.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
ulpqueue.c net: Remove unnecessary returns from void function()s 2010-05-17 23:23:14 -07:00