diff options
| author | Dan Rosenberg <drosenberg@vsecurity.com> | 2010-11-12 12:44:42 -0800 |
|---|---|---|
| committer | Willy Tarreau <w@1wt.eu> | 2010-12-12 21:49:35 +0100 |
| commit | a7d7e94124970e0361ecad496de235fc0dd6517d (patch) | |
| tree | 4db145b4f5bfb208d94af5bb81f5e150290ebb67 | |
| parent | e335f5515906bc78c194afb9f5b065ffa56e7045 (diff) | |
| download | linux-2.4-a7d7e94124970e0361ecad496de235fc0dd6517d.tar.gz | |
x25: Prevent crashing when parsing bad X.25 facilities
Now with improved comma support.
On parsing malformed X.25 facilities, decrementing the remaining length
may cause it to underflow. Since the length is an unsigned integer,
this will result in the loop continuing until the kernel crashes.
This patch adds checks to ensure decrementing the remaining length does
not cause it to wrap around.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from 2.6 commit a6331d6f9a4298173b413cf99a40cc86a9d92c37)
| -rw-r--r-- | net/x25/x25_facilities.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c index bdd0fd096b9e04..a9f452c865eca5 100644 --- a/net/x25/x25_facilities.c +++ b/net/x25/x25_facilities.c @@ -54,6 +54,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities, while (len > 0) { switch (*p & X25_FAC_CLASS_MASK) { case X25_FAC_CLASS_A: + if (len < 2) + return 0; switch (*p) { case X25_FAC_REVERSE: facilities->reverse = (p[1] & 0x01); @@ -72,6 +74,8 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities, break; case X25_FAC_CLASS_B: + if (len < 3) + return 0; switch (*p) { case X25_FAC_PACKET_SIZE: facilities->pacsize_in = p[1]; @@ -92,13 +96,17 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities, break; case X25_FAC_CLASS_C: + if (len < 4) + return 0; printk(KERN_DEBUG "X.25: unknown facility %02X, values %02X, %02X, %02X\n", p[0], p[1], p[2], p[3]); p += 4; len -= 4; break; case X25_FAC_CLASS_D: - printk(KERN_DEBUG "X.25: unknown facility %02X, length %d, values %02X, %02X, %02X, %02X\n", p[0], p[1], p[2], p[3], p[4], p[5]); + if (len < p[1] + 2) + return 0; + printk(KERN_DEBUG "X.25: unknown facility %02X, length %d\n", p[0], p[1]); len -= p[1] + 2; p += p[1] + 2; break; |