aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthew Daley <mattjd@gmail.com>2013-03-19 12:36:47 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-04-05 10:16:37 -0700
commit21f9f5219401be3815db41e60072a53dadf828b6 (patch)
treed675922b71de29cbcdb465ccaa6357a1dc80b7b3
parentd104388ff9bdb5ec76d5337cd94f9ed4bbf73fbc (diff)
downloadlinux-linaro-stable-21f9f5219401be3815db41e60072a53dadf828b6.tar.gz
x25: Validate incoming call user data lengths
commit c7fd0d48bde943e228e9c28ce971a22d6a1744c4 upstream. X.25 call user data is being copied in its entirety from incoming messages without consideration to the size of the destination buffers, leading to possible buffer overflows. Validate incoming call user data lengths before these copies are performed. It appears this issue was noticed some time ago, however nothing seemed to come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and commit 8db09f26f912f7c90c764806e804b558da520d4f. Signed-off-by: Matthew Daley <mattjd@gmail.com> Acked-by: Eric Dumazet <eric.dumazet@gmail.com> Tested-by: Andrew Hendry <andrew.hendry@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--net/x25/af_x25.c6
-rw-r--r--net/x25/x25_in.c3
2 files changed, 9 insertions, 0 deletions
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 373e14f21a17..8c0346f00e68 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -960,6 +960,12 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
skb_pull(skb,len);
/*
+ * Ensure that the amount of call user data is valid.
+ */
+ if (skb->len > X25_MAX_CUD_LEN)
+ goto out_clear_request;
+
+ /*
* Find a listener for the particular address/cud pair.
*/
sk = x25_find_listener(&source_addr,skb);
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 15de65f04719..b1180cc28669 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -127,6 +127,9 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
* Copy any Call User Data.
*/
if (skb->len > 0) {
+ if (skb->len > X25_MAX_CUD_LEN)
+ goto out_clear;
+
skb_copy_from_linear_data(skb,
x25->calluserdata.cuddata,
skb->len);