summaryrefslogtreecommitdiff
path: root/net/dccp
diff options
context:
space:
mode:
authorDan Rosenberg <drosenberg@vsecurity.com>2011-05-06 03:27:18 (GMT)
committerDavid S. Miller <davem@davemloft.net>2011-05-06 20:05:50 (GMT)
commita294865978b701e4d0d90135672749531b9a900d (patch)
tree4edb7c20db20d81867562fc5cbc0d7c7b5a70df5 /net/dccp
parent87e9af6cc67d842cd92b52b81f3f14e665e7ab05 (diff)
downloadlinux-a294865978b701e4d0d90135672749531b9a900d.tar.xz
dccp: handle invalid feature options length
A length of zero (after subtracting two for the type and len fields) for the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to the subtraction. The subsequent code may read past the end of the options value buffer when parsing. I'm unsure of what the consequences of this might be, but it's probably not good. Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com> Cc: stable@kernel.org Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/dccp')
-rw-r--r--net/dccp/options.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/net/dccp/options.c b/net/dccp/options.c
index f06ffcf..4b2ab65 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -123,6 +123,8 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R:
if (pkt_type == DCCP_PKT_DATA) /* RFC 4340, 6 */
break;
+ if (len == 0)
+ goto out_invalid_option;
rc = dccp_feat_parse_options(sk, dreq, mandatory, opt,
*value, value + 1, len - 1);
if (rc)