Skip site navigation (1)Skip section navigation (2) 
Date:      Thu, 7 May 2020 02:40:08 +0000 (UTC)
From:      Michael Tuexen <tuexen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r360752 - stable/11/sys/netinet
Message-ID:  <202005070240.0472e8qY000726@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: tuexen
Date: Thu May  7 02:40:08 2020
New Revision: 360752
URL: https://svnweb.freebsd.org/changeset/base/360752

Log:
  MFC r355931: Improve input validation
  
  Improve input validation for some parameters having a too small
  reported length.
  
  Thanks to Natalie Silvanovich from Google for finding one of these
  issues in the SCTP userland stack and reporting it.

Modified:
  stable/11/sys/netinet/sctp_auth.c
  stable/11/sys/netinet/sctp_pcb.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet/sctp_auth.c
==============================================================================
--- stable/11/sys/netinet/sctp_auth.c	Thu May  7 02:34:58 2020	(r360751)
+++ stable/11/sys/netinet/sctp_auth.c	Thu May  7 02:40:08 2020	(r360752)
@@ -1429,7 +1429,8 @@ sctp_auth_get_cookie_params(struct sctp_tcb *stcb, str
 		ptype = ntohs(phdr->param_type);
 		plen = ntohs(phdr->param_length);
 
-		if ((plen == 0) || (offset + plen > length))
+		if ((plen < sizeof(struct sctp_paramhdr)) ||
+		    (offset + plen > length))
 			break;
 
 		if (ptype == SCTP_RANDOM) {

Modified: stable/11/sys/netinet/sctp_pcb.c
==============================================================================
--- stable/11/sys/netinet/sctp_pcb.c	Thu May  7 02:34:58 2020	(r360751)
+++ stable/11/sys/netinet/sctp_pcb.c	Thu May  7 02:40:08 2020	(r360752)
@@ -6205,7 +6205,7 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, s
 		if (offset + plen > limit) {
 			break;
 		}
-		if (plen == 0) {
+		if (plen < sizeof(struct sctp_paramhdr)) {
 			break;
 		}
 #ifdef INET
@@ -6430,6 +6430,9 @@ sctp_load_addresses_from_init(struct sctp_tcb *stcb, s
 			}
 			if (plen > sizeof(lstore)) {
 				return (-23);
+			}
+			if (plen < sizeof(struct sctp_asconf_addrv4_param)) {
+				return (-101);
 			}
 			phdr = sctp_get_next_param(m, offset,
 			    (struct sctp_paramhdr *)&lstore,

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202005070240.0472e8qY000726>