Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Missing return in error path in sctp_handle_asconf() #376

Closed
markwo opened this issue Sep 19, 2019 · 1 comment
Closed

Missing return in error path in sctp_handle_asconf() #376

markwo opened this issue Sep 19, 2019 · 1 comment

Comments

@markwo
Copy link

markwo commented Sep 19, 2019

usrsctp/usrsctplib/netinet/sctp_asconf.c

Line 722 in 8ca1321

sctp_m_freem(m_ack);

@markwo markwo changed the title Missing return in error path in sctp_handle_asconf Missing return in error path in sctp_handle_asconf() Sep 19, 2019
tuexen added a commit to sctplab/stream-reset-improved that referenced this issue Sep 20, 2019
@tuexen
Fix the handling of invalid parameters in ASCONF chunks.
264ce45 
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.
tuexen added a commit to sctplab/pr-sctp-improved that referenced this issue Sep 20, 2019
@tuexen
Fix the handling of invalid parameters in ASCONF chunks.
0fe5c7f 
Thanks to Mark Wodrich from Google for reporting the issue in
sctplab/usrsctp#376
for the userland stack.
tuexen added a commit to sctplab/SCTP_NKE_ElCapitan that referenced this issue Sep 20, 2019
@tuexen
Fix the handling of invalid parameters in ASCONF chunks.
bd42efc 
Thanks to Mark Wodrich from Google for reporting the issue in
sctplab/usrsctp#376
for the userland stack.
tuexen added a commit to sctplab/SCTP_NKE_Yosemite that referenced this issue Sep 20, 2019
@tuexen
Fix the handling of invalid parameters in ASCONF chunks.
a4f9c93 
Thanks to Mark Wodrich from Google for reporting the issue in
sctplab/usrsctp#376
for the userland stack.
tuexen added a commit to sctplab/SCTP_NKE_HighSierra that referenced this issue Sep 20, 2019
@tuexen
Fix the handling of invalid parameters in ASCONF chunks.
f10c6b5 
Thanks to Mark Wodrich from Google for reporting the issue in
sctplab/usrsctp#376
for the userland stack.
tuexen added a commit to sctplab/sctp-idata that referenced this issue Sep 20, 2019
@tuexen
Fix the handling of invalid parameters in ASCONF chunks.
a12f402 
Thanks to Mark Wodrich from Google for reporting the issue in
sctplab/usrsctp#376
for the userland stack.
tuexen added a commit that referenced this issue Sep 20, 2019
@tuexen
Fix the handling of invalid parameters in ASCONF chunks.
ac36440 
Thanks to Mark Wodrich from Google for reporting the issue in
#376
for the userland stack.
@tuexen
Copy link
Member

tuexen commented Sep 20, 2019

Fixed in ac36440. Thanks for finding and reporting!

@tuexen tuexen closed this as completed Sep 20, 2019
uqs pushed a commit to freebsd/freebsd-src that referenced this issue Sep 20, 2019
Fix the handling of invalid parameters in ASCONF chunks.
2336dc1 
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.

MFC after:		3 days


git-svn-id: svn+ssh://svn.freebsd.org/base/head@352550 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
uqs pushed a commit to freebsd/freebsd-src that referenced this issue Sep 22, 2019
@tuexen
Fix the handling of invalid parameters in ASCONF chunks.
f8c515c 
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.

MFC after:		3 days
mat813 pushed a commit to mat813/freebsd that referenced this issue Sep 23, 2019
Fix the handling of invalid parameters in ASCONF chunks.
bce00f0 
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.

MFC after:		3 days


git-svn-id: https://svn.freebsd.org/base/head@352550 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
uqs pushed a commit to freebsd/freebsd-src that referenced this issue Sep 25, 2019
@tuexen
MFC r352550:
ab82c97 
Fix the handling of invalid parameters in ASCONF chunks.
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.
mat813 pushed a commit to mat813/freebsd that referenced this issue Oct 2, 2019
MFC r352550:
82e3cc6 
Fix the handling of invalid parameters in ASCONF chunks.
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.


git-svn-id: https://svn.freebsd.org/base/stable/12@352674 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
uqs pushed a commit to freebsd/freebsd-src that referenced this issue Oct 3, 2019
@tuexen
MFS r352509:
a253651 
Only allow a SCTP-AUTH shared key to be updated by the application
if it is not deactivated and not used.
This avoids a use-after-free problem.

MFS r352674:

Fix the handling of invalid parameters in ASCONF chunks.
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.

MFS r352675:

Cleanup the RTO calculation and perform some consistency checks
before computing the RTO.
This should fix an overflow issue reported by Felix Weinrank in
sctplab/usrsctp#375
for the userland stack and found by running a fuzz tester.

MFS r352676:

Don't hold the info lock when calling sctp_select_a_tag().
This avoids a double lock bug in the NAT colliding state processing
of SCTP. Thanks to Felix Weinrank for finding and reporting this issue in
sctplab/usrsctp#374
He found this bug using fuzz testing.

MFS r353034:

Plumb a memory leak.
Thanks to Felix Weinrank for finding this issue using fuzz testing
and reporting it for the userland stack:
sctplab/usrsctp#378

MFS r353036:

Don't use stack memory which is not initialized.
Thanks to Mark Wodrich for reporting this issue for the userland stack in
sctplab/usrsctp#380
This issue was also found for usrsctp by OSS-fuzz in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17778

Approved by:		re (kib@)
mat813 pushed a commit to mat813/freebsd that referenced this issue Oct 7, 2019
MFS r352509:
9504a1a 
Only allow a SCTP-AUTH shared key to be updated by the application
if it is not deactivated and not used.
This avoids a use-after-free problem.

MFS r352674:

Fix the handling of invalid parameters in ASCONF chunks.
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.

MFS r352675:

Cleanup the RTO calculation and perform some consistency checks
before computing the RTO.
This should fix an overflow issue reported by Felix Weinrank in
sctplab/usrsctp#375
for the userland stack and found by running a fuzz tester.

MFS r352676:

Don't hold the info lock when calling sctp_select_a_tag().
This avoids a double lock bug in the NAT colliding state processing
of SCTP. Thanks to Felix Weinrank for finding and reporting this issue in
sctplab/usrsctp#374
He found this bug using fuzz testing.

MFS r353034:

Plumb a memory leak.
Thanks to Felix Weinrank for finding this issue using fuzz testing
and reporting it for the userland stack:
sctplab/usrsctp#378

MFS r353036:

Don't use stack memory which is not initialized.
Thanks to Mark Wodrich for reporting this issue for the userland stack in
sctplab/usrsctp#380
This issue was also found for usrsctp by OSS-fuzz in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17778

Approved by:		re (kib@)


git-svn-id: https://svn.freebsd.org/base/releng/12.1@353045 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
brooksdavis pushed a commit to CTSRD-CHERI/cheribsd that referenced this issue Oct 22, 2019
@tuexen @brooksdavis
Fix the handling of invalid parameters in ASCONF chunks.
6192117 
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.

MFC after:		3 days
fichtner pushed a commit to opnsense/src that referenced this issue Oct 29, 2019
@tuexen @fichtner
MFS r352509:
6cfb164 
Only allow a SCTP-AUTH shared key to be updated by the application
if it is not deactivated and not used.
This avoids a use-after-free problem.

MFS r352674:

Fix the handling of invalid parameters in ASCONF chunks.
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.

MFS r352675:

Cleanup the RTO calculation and perform some consistency checks
before computing the RTO.
This should fix an overflow issue reported by Felix Weinrank in
sctplab/usrsctp#375
for the userland stack and found by running a fuzz tester.

MFS r352676:

Don't hold the info lock when calling sctp_select_a_tag().
This avoids a double lock bug in the NAT colliding state processing
of SCTP. Thanks to Felix Weinrank for finding and reporting this issue in
sctplab/usrsctp#374
He found this bug using fuzz testing.

MFS r353034:

Plumb a memory leak.
Thanks to Felix Weinrank for finding this issue using fuzz testing
and reporting it for the userland stack:
sctplab/usrsctp#378

MFS r353036:

Don't use stack memory which is not initialized.
Thanks to Mark Wodrich for reporting this issue for the userland stack in
sctplab/usrsctp#380
This issue was also found for usrsctp by OSS-fuzz in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17778

Approved by:		re (kib@)
uqs pushed a commit to freebsd/freebsd-src that referenced this issue May 7, 2020
@tuexen
MFC r352550: Fix invalid handling of ASCONF chunks
a4f9f9b 
Fix the handling of invalid parameters in ASCONF chunks.
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.
mat813 pushed a commit to mat813/freebsd that referenced this issue Jun 9, 2020
MFC r352550: Fix invalid handling of ASCONF chunks
0563c65 
Fix the handling of invalid parameters in ASCONF chunks.
Thanks to Mark Wodrich from Google for reproting the issue in
sctplab/usrsctp#376
for the userland stack.


git-svn-id: https://svn.freebsd.org/base/stable/11@360734 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f
@yuquanw2 yuquanw2 mentioned this issue Jun 19, 2020
Closed
jmb202 pushed a commit to pexip/usrsctp that referenced this issue Jun 22, 2020
@tuexen @jmb202
Fix the handling of invalid parameters in ASCONF chunks.
e5c7627 
Thanks to Mark Wodrich from Google for reporting the issue in
sctplab/usrsctp#376
for the userland stack.

(cherry picked from commit ac36440)
@yuquanw2 yuquanw2 mentioned this issue Jun 22, 2020
Merged
@feross feross mentioned this issue Nov 18, 2020
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@tuexen @markwo