| commit | 14b5b45fc02db990eaa44b943b8f0576421051ef | |
| author | Dan Rosenberg <drosenberg@vsecurity.com> | |
| Fri, 6 May 2011 03:27:18 +0000 (6 03:27 +0000) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Mon, 23 May 2011 18:20:15 +0000 (23 11:20 -0700) | ||
| tree | 1332434b0e3d1dc4e474bcfeab8dfb510673e293 | treesnapshot (tar.gz zip) |
| parent | 88b5ff36c09c33d8b47d4c485bbb9c4ec136232b | commitdiff |
dccp: handle invalid feature options length
commit a294865978b701e4d0d90135672749531b9a900d upstream.
A length of zero (after subtracting two for the type and len fields) for
the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to
the subtraction. The subsequent code may read past the end of the
options value buffer when parsing. I'm unsure of what the consequences
of this might be, but it's probably not good.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit a294865978b701e4d0d90135672749531b9a900d upstream.
A length of zero (after subtracting two for the type and len fields) for
the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to
the subtraction. The subsequent code may read past the end of the
options value buffer when parsing. I'm unsure of what the consequences
of this might be, but it's probably not good.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| net/dccp/options.c | diffblobblamehistory |