Commit 211856e4 authored by Marcelo Ricardo Leitner's avatar Marcelo Ricardo Leitner Committed by Todd Kjos
Browse files

UPSTREAM: sctp: add param size validation for SCTP_PARAM_SET_PRIMARY



commit ef6c8d6c upstream.

When SCTP handles an INIT chunk, it calls for example:
sctp_sf_do_5_1B_init
  sctp_verify_init
    sctp_verify_param
  sctp_process_init
    sctp_process_param
      handling of SCTP_PARAM_SET_PRIMARY

sctp_verify_init() wasn't doing proper size validation and neither the
later handling, allowing it to work over the chunk itself, possibly being
uninitialized memory.

Bug: 197154735
Signed-off-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarAaron Ding <aaronding@google.com>
Change-Id: I032230924ead7a03dfb3101e9cd4d48e36bfc616
parent 0f370e20
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment