Dan Rosenberg aadbd20969 sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac() ... commit 51e97a12be upstream. The sctp_asoc_get_hmac() function iterates through a peer's hmac_ids array and attempts to ensure that only a supported hmac entry is returned. The current code fails to do this properly - if the last id in the array is out of range (greater than SCTP_AUTH_HMAC_ID_MAX), the id integer remains set after exiting the loop, and the address of an out-of-bounds entry will be returned and subsequently used in the parent function, causing potentially ugly memory corruption. This patch resets the id integer to 0 on encountering an invalid id so that NULL will be returned after finishing the loop if no valid ids are found. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>		2011-04-30 16:53:02 +02:00
..
9p	9p: fix put_data error handling	2008-09-24 16:22:22 -05:00
802	list_for_each_rcu must die: networking	2008-07-25 10:53:27 -07:00
8021q	net: fix packet socket delivery in rx irq handler	2009-02-06 14:00:36 -08:00
appletalk	appletalk: Fix skb leak when ipddp interface is not loaded (CVE-2009-2903)	2009-11-09 16:52:22 -08:00
atm	ATM: CVE-2008-5079: duplicate listen() on socket corrupts the vcc table	2008-12-13 15:29:17 -08:00
ax25	ax25: Fix possible oops in ax25_make_new	2010-04-01 15:52:18 -07:00
bluetooth	bluetooth hid: enable quirk handling for Apple Wireless Keyboards in 2.6.27	2009-02-17 09:46:28 -08:00
bridge	netfilter: ebtables: enforce CAP_NET_ADMIN	2010-01-18 10:33:47 -08:00
can	can-bcm: fix minor heap overflow	2010-12-09 13:24:21 -08:00
core	net: Fix the condition passed to sk_wait_event()	2010-12-09 13:24:20 -08:00
dccp	dccp: Fix panic caused by too early termination of retransmission mechanism	2008-08-18 21:14:20 -07:00
decnet	DECnet: don't leak uninitialized stack byte	2010-12-09 13:24:19 -08:00
econet	econet: fix CVE-2010-3850	2010-12-09 13:24:21 -08:00
ethernet	[NET]: Return more appropriate error from eth_validate_addr().	2008-04-13 22:45:40 -07:00
ieee80211	wext: Emit event stream entries correctly when compat.	2008-06-16 18:50:49 -07:00
ipv4	tcp: Fix race in tcp_poll	2010-12-09 13:24:20 -08:00
ipv6	ipv6: conntrack: Add member of user to nf_ct_frag6_queue structure	2010-12-09 13:24:20 -08:00
ipx	netns: Use net_eq() to compare net-namespaces for optimization.	2008-07-19 22:34:43 -07:00
irda	irda: Fix heap memory corruption in iriap.c	2010-12-09 13:24:15 -08:00
iucv	iucv: Fix mismerge again.	2008-09-30 03:03:35 -07:00
key	key: fix setkey(8) policy set breakage	2008-12-18 09:13:38 -08:00
lapb	[LAPB] net/lapb/lapb_iface.c: use LIST_HEAD instead of LIST_HEAD_INIT	2008-01-28 14:56:52 -08:00
llc	NET: llc, zero sockaddr_llc struct	2009-09-08 20:17:41 -07:00
mac80211	mac80211: pid, fix memory corruption	2009-06-11 20:01:36 -07:00
netfilter	netfilter: nf_conntrack_tcp: fix unaligned memory access in tcp_sack	2009-05-02 10:23:53 -07:00
netlabel	netns: Use net_eq() to compare net-namespaces for optimization.	2008-07-19 22:34:43 -07:00
netlink	net: convert BUG_TRAP to generic WARN_ON	2008-07-25 21:43:18 -07:00
netrom	netrom: Fix nr_getname() leak	2009-09-08 20:17:42 -07:00
packet	net: Make the copy length in af_packet sockopt handler unsigned	2009-10-05 08:11:47 -07:00
rfkill	rfkill: update LEDs for all state changes	2008-10-18 10:49:12 -07:00
rose	rose: Fix signedness issues wrt. digi count.	2010-12-09 13:24:19 -08:00
rxrpc	net/rxrpc: Use an IS_ERR test rather than a NULL test	2008-08-13 02:40:48 -07:00
sched	tc: Fix unitialized kernel memory leak	2010-04-01 15:52:24 -07:00
sctp	sctp: Fix out-of-bounds reading in sctp_asoc_get_hmac()	2011-04-30 16:53:02 +02:00
sunrpc	sunrpc: prevent use-after-free on clearing XPT_BUSY	2011-02-09 22:15:38 +01:00
tipc	tipc: Fix oops on send prior to entering networked mode (v3)	2010-07-05 11:08:47 -07:00
unix	net: unix: fix sending fds in multiple buffers	2010-04-01 15:52:18 -07:00
wanrouter	wanmain.c doesn't need syncppp.h	2008-07-23 23:00:36 +02:00
wireless	wext: fix potential private ioctl memory content leak	2010-10-28 21:04:15 -07:00
x25	x25: Prevent crashing when parsing bad X.25 facilities	2010-12-09 13:24:21 -08:00
xfrm	ipsec: Fix name of CAST algorithm	2009-07-30 16:06:12 -07:00
compat.c	flag parameters: paccept	2008-07-24 10:47:27 -07:00
Kconfig	net: Make "networking" one-click deselectable.	2008-07-30 03:27:53 -07:00
Makefile	vlan: uninline __vlan_hwaccel_rx	2008-07-08 03:23:36 -07:00
nonet.c
socket.c	net: Truncate recvfrom and sendto length to INT_MAX.	2010-12-09 13:24:20 -08:00
sysctl_net.c	missing bits of net-namespace / sysctl	2008-07-27 09:45:34 -07:00
TUNABLE