Commit c7fd0d48 authored Oct 14, 2011 by Matthew Daley Committed by David S. Miller Oct 17, 2011

x25: Validate incoming call user data lengths

X.25 call user data is being copied in its entirety from incoming messages
without consideration to the size of the destination buffers, leading to
possible buffer overflows. Validate incoming call user data lengths before
these copies are performed.

It appears this issue was noticed some time ago, however nothing seemed to
come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html

 and
commit 8db09f26.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Andrew Hendry <andrew.hendry@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent f36c23bb

net/x25/af_x25.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -958,6 +958,12 @@ int x25_rx_call_request(struct sk_buff skb, struct x25_neigh nb,
		goto out_clear_request;
		skb_pull(skb,len);

		/*
		* Ensure that the amount of call user data is valid.
		*/
		if (skb->len > X25_MAX_CUD_LEN)
		goto out_clear_request;

		/*
		* Find a listener for the particular address/cud pair.
		*/

net/x25/x25_in.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -127,6 +127,9 @@ static int x25_state1_machine(struct sock sk, struct sk_buff skb, int frametyp
		* Copy any Call User Data.
		*/
		if (skb->len > 0) {
		if (skb->len > X25_MAX_CUD_LEN)
		goto out_clear;

		skb_copy_from_linear_data(skb,
		x25->calluserdata.cuddata,
		skb->len);

Admin message