A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 11:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

x25: Validate incoming call user data lengths

Browse source 
X.25 call user data is being copied in its entirety from incoming messages
without consideration to the size of the destination buffers, leading to
possible buffer overflows. Validate incoming call user data lengths before
these copies are performed.

It appears this issue was noticed some time ago, however nothing seemed to
come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and
commit 8db09f26f9.

Signed-off-by: Matthew Daley <[email protected]>
Acked-by: Eric Dumazet <[email protected]>
Tested-by: Andrew Hendry <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
This commit is contained in:
Matthew Daley 2011-10-14 18:45:03 +00:00 • committed by David S. Miller
commit c7fd0d48bd
2 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
net/x25/af_x25.c
View file

@ -958,6 +958,12 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
goto out_clear_request;
skb_pull(skb,len);
/*
* Ensure that the amount of call user data is valid.
*/
if (skb->len > X25_MAX_CUD_LEN)
goto out_clear_request;
/*
* Find a listener for the particular address/cud pair.
*/

3
net/x25/x25_in.c
View file

@ -127,6 +127,9 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
* Copy any Call User Data.
*/
if (skb->len > 0) {
if (skb->len > X25_MAX_CUD_LEN)
goto out_clear;
skb_copy_from_linear_data(skb,
x25->calluserdata.cuddata,
skb->len);