Skip to content

Commit

Permalink
Improve input validation when processing AUTH chunks.
Browse files Browse the repository at this point in the history 
Thanks to Natalie Silvanovich from Google for finding and reporting the
issue found by her in the SCTP userland stack.

MFC after:		3 days
X-MFC with:		https://svnweb.freebsd.org/changeset/base/360193
  • Loading branch information
@tuexen
tuexen committed Apr 22, 2020
1 parent 69a3eb6 commit 8262311
Showing 1 changed file with 9 additions and 7 deletions.
16 changes: 9 additions & 7 deletions sys/netinet/sctp_input.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2094,7 +2094,7 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
int init_offset, initack_offset, initack_limit;
int retval;
int error = 0;
uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
uint8_t auth_chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
#if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
struct socket *so;

Expand Down Expand Up @@ -2273,7 +2273,7 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, int offset,
if (auth_skipped) {
struct sctp_auth_chunk *auth;

if (auth_len <= SCTP_PARAM_BUFFER_SIZE) {
if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
auth = (struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
} else {
auth = NULL;
Expand Down Expand Up @@ -4670,11 +4670,13 @@ sctp_process_control(struct mbuf *m, int iphlen, int *offset, int length,
if (auth_skipped && (stcb != NULL)) {
struct sctp_auth_chunk *auth;

auth = (struct sctp_auth_chunk *)
sctp_m_getptr(m, auth_offset,
auth_len, chunk_buf);
got_auth = 1;
auth_skipped = 0;
if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
auth = (struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, chunk_buf);
got_auth = 1;
auth_skipped = 0;
} else {
auth = NULL;
}
if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
auth_offset)) {
/* auth HMAC failed so dump it */
Expand Down

0 comments on commit 8262311

Please sign in to comment.