Skip to content

Commit 790a7a2

Browse files
committed
Improve input validation for some parameters having a too small
reported length. Thanks to Natalie Silvanovich from Google for finding one of these issues in the SCTP userland stack and reporting it.
1 parent 72320b5 commit 790a7a2

File tree

2 files changed

+8
-4
lines changed

2 files changed

+8
-4
lines changed

Diff for: usrsctplib/netinet/sctp_auth.c

+3-2
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434

3535
#ifdef __FreeBSD__
3636
#include <sys/cdefs.h>
37-
__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 352438 2019-09-17 09:46:42Z tuexen $");
37+
__FBSDID("$FreeBSD: head/sys/netinet/sctp_auth.c 355931 2019-12-20 15:25:08Z tuexen $");
3838
#endif
3939

4040
#include <netinet/sctp_os.h>
@@ -1421,7 +1421,8 @@ sctp_auth_get_cookie_params(struct sctp_tcb *stcb, struct mbuf *m,
14211421
ptype = ntohs(phdr->param_type);
14221422
plen = ntohs(phdr->param_length);
14231423

1424-
if ((plen == 0) || (offset + plen > length))
1424+
if ((plen < sizeof(struct sctp_paramhdr)) ||
1425+
(offset + plen > length))
14251426
break;
14261427

14271428
if (ptype == SCTP_RANDOM) {

Diff for: usrsctplib/netinet/sctp_pcb.c

+5-2
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434

3535
#ifdef __FreeBSD__
3636
#include <sys/cdefs.h>
37-
__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 353477 2019-10-13 16:14:04Z markj $");
37+
__FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 355931 2019-12-20 15:25:08Z tuexen $");
3838
#endif
3939

4040
#include <netinet/sctp_os.h>
@@ -7247,7 +7247,7 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
72477247
if (offset + plen > limit) {
72487248
break;
72497249
}
7250-
if (plen == 0) {
7250+
if (plen < sizeof(struct sctp_paramhdr)) {
72517251
break;
72527252
}
72537253
#ifdef INET
@@ -7463,6 +7463,9 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
74637463
if (plen > sizeof(lstore)) {
74647464
return (-23);
74657465
}
7466+
if (plen < sizeof(struct sctp_asconf_addrv4_param)) {
7467+
return (-101);
7468+
}
74667469
phdr = sctp_get_next_param(m, offset,
74677470
(struct sctp_paramhdr *)&lstore,
74687471
plen);

0 commit comments

Comments
 (0)