aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDan Rosenberg <drosenberg@vsecurity.com>2011-05-06 03:27:18 +0000
committerGreg Kroah-Hartman <gregkh@suse.de>2011-05-21 15:13:09 -0700
commita7d9222022375081576a7909167869a0bf1ed44c (patch)
tree80fdb484dd6f80a2d0b2bc386143e3edce4a5b17
parent10bb564c39e90bb0a23bd925490e8cf1a7af9372 (diff)
downloadlinux-linaro-android-a7d9222022375081576a7909167869a0bf1ed44c.tar.gz
dccp: handle invalid feature options length
commit a294865978b701e4d0d90135672749531b9a900d upstream. A length of zero (after subtracting two for the type and len fields) for the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to the subtraction. The subsequent code may read past the end of the options value buffer when parsing. I'm unsure of what the consequences of this might be, but it's probably not good. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--net/dccp/options.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/dccp/options.c b/net/dccp/options.c
index f06ffcfc8d7..4b2ab657ac8 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -123,6 +123,8 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R:
if (pkt_type == DCCP_PKT_DATA) /* RFC 4340, 6 */
break;
+ if (len == 0)
+ goto out_invalid_option;
rc = dccp_feat_parse_options(sk, dreq, mandatory, opt,
*value, value + 1, len - 1);
if (rc)