Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933991Ab1ESSV4 (ORCPT ); Thu, 19 May 2011 14:21:56 -0400 Received: from out2.smtp.messagingengine.com ([66.111.4.26]:48498 "EHLO out2.smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933914Ab1ESSIJ (ORCPT ); Thu, 19 May 2011 14:08:09 -0400 X-Sasl-enc: ucAFgFJ4KCMlcT1agiVGXWz1tHZK7C27YUFwXqvh9WOZ 1305828489 X-Mailbox-Line: From gregkh@clark.kroah.org Thu May 19 11:05:56 2011 Message-Id: <20110519180556.109515174@clark.kroah.org> User-Agent: quilt/0.48-16.4 Date: Thu, 19 May 2011 11:04:47 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: stable-review@kernel.org, torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, Dan Rosenberg , Gerrit Renker , "David S. Miller" Subject: [19/71] dccp: handle invalid feature options length In-Reply-To: <20110519180626.GA16555@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1445 Lines: 41 2.6.38-stable review patch. If anyone has any objections, please let us know. ------------------ From: Dan Rosenberg commit a294865978b701e4d0d90135672749531b9a900d upstream. A length of zero (after subtracting two for the type and len fields) for the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to the subtraction. The subsequent code may read past the end of the options value buffer when parsing. I'm unsure of what the consequences of this might be, but it's probably not good. Signed-off-by: Dan Rosenberg Acked-by: Gerrit Renker Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/dccp/options.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/dccp/options.c +++ b/net/dccp/options.c @@ -123,6 +123,8 @@ int dccp_parse_options(struct sock *sk, case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R: if (pkt_type == DCCP_PKT_DATA) /* RFC 4340, 6 */ break; + if (len == 0) + goto out_invalid_option; rc = dccp_feat_parse_options(sk, dreq, mandatory, opt, *value, value + 1, len - 1); if (rc) -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/