Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-10 07:00:48 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[SCTP]: Incorrect length was used in SCTP_*_AUTH_CHUNKS socket option

Browse Source 
The chunks are stored inside a parameter structure in the kernel
and when we copy them to the user, we need to account for
the parameter header.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
This commit is contained in:
Vlad Yasevich 2008-02-27 14:40:37 -05:00
parent 15efbe7639
commit b40db68468
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
net/sctp/socket.c
View File

@ -5070,6 +5070,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
struct sctp_authchunks val; struct sctp_authchunks val;
struct sctp_association *asoc; struct sctp_association *asoc;
struct sctp_chunks_param *ch; struct sctp_chunks_param *ch;
u32 num_chunks;
char __user *to; char __user *to;
if (len <= sizeof(struct sctp_authchunks)) if (len <= sizeof(struct sctp_authchunks))
@ -5086,10 +5087,11 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
ch = asoc->peer.peer_chunks; ch = asoc->peer.peer_chunks;
/* See if the user provided enough room for all the data */ /* See if the user provided enough room for all the data */
if (len < ntohs(ch->param_hdr.length)) num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
if (len < num_chunks)
return -EINVAL; return -EINVAL;
len = ntohs(ch->param_hdr.length); len = num_chunks;
if (put_user(len, optlen)) if (put_user(len, optlen))
return -EFAULT; return -EFAULT;
if (copy_to_user(to, ch->chunks, len)) if (copy_to_user(to, ch->chunks, len))
@ -5105,6 +5107,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
struct sctp_authchunks val; struct sctp_authchunks val;
struct sctp_association *asoc; struct sctp_association *asoc;
struct sctp_chunks_param *ch; struct sctp_chunks_param *ch;
u32 num_chunks;
char __user *to; char __user *to;
if (len <= sizeof(struct sctp_authchunks)) if (len <= sizeof(struct sctp_authchunks))
@ -5123,10 +5126,11 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
else else
ch = sctp_sk(sk)->ep->auth_chunk_list; ch = sctp_sk(sk)->ep->auth_chunk_list;
if (len < ntohs(ch->param_hdr.length)) num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
if (len < num_chunks)
return -EINVAL; return -EINVAL;
len = ntohs(ch->param_hdr.length); len = num_chunks;
if (put_user(len, optlen)) if (put_user(len, optlen))
return -EFAULT; return -EFAULT;
if (copy_to_user(to, ch->chunks, len)) if (copy_to_user(to, ch->chunks, len))