Skip to content
Permalink
Browse files Browse the repository at this point in the history
Improve input validation for some parameters having a too small
reported length.

Thanks to Natalie Silvanovich from Google for finding one of these
issues in the SCTP userland stack and reporting it.
  • Loading branch information
tuexen committed Dec 20, 2019
1 parent 72320b5 commit 790a7a2
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 4 deletions.
5 changes: 3 additions & 2 deletions usrsctplib/netinet/sctp_auth.c
Expand Up @@ -34,7 +34,7 @@

#ifdef __FreeBSD__
#include <sys/cdefs.h>
__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 352438 2019-09-17 09:46:42Z tuexen $");
__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 355931 2019-12-20 15:25:08Z tuexen $");
#endif

#include <netinet/sctp_os.h>
Expand Down Expand Up @@ -1421,7 +1421,8 @@ sctp_auth_get_cookie_params(struct sctp_tcb *stcb, struct mbuf *m,
ptype = ntohs(phdr->param_type);
plen = ntohs(phdr->param_length);

if ((plen == 0) || (offset + plen > length))
if ((plen < sizeof(struct sctp_paramhdr)) ||
(offset + plen > length))
break;

if (ptype == SCTP_RANDOM) {
Expand Down
7 changes: 5 additions & 2 deletions usrsctplib/netinet/sctp_pcb.c
Expand Up @@ -34,7 +34,7 @@

#ifdef __FreeBSD__
#include <sys/cdefs.h>
__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 353477 2019-10-13 16:14:04Z markj $");
__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 355931 2019-12-20 15:25:08Z tuexen $");
#endif

#include <netinet/sctp_os.h>
Expand Down Expand Up @@ -7247,7 +7247,7 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
if (offset + plen > limit) {
break;
}
if (plen == 0) {
if (plen < sizeof(struct sctp_paramhdr)) {
break;
}
#ifdef INET
Expand Down Expand Up @@ -7463,6 +7463,9 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
if (plen > sizeof(lstore)) {
return (-23);
}
if (plen < sizeof(struct sctp_asconf_addrv4_param)) {
return (-101);
}
phdr = sctp_get_next_param(m, offset,
(struct sctp_paramhdr *)&lstore,
plen);
Expand Down

0 comments on commit 790a7a2

Please sign in to comment.