* Patrick McHardy <[email protected]> wrote:
> Ingo Molnar wrote:
> > thinking about it, what prevents the SCTP chunk's len field from being
> > zero, and thus causing an infinite loop in for_each_sctp_chunk()? The
> > patch below should fix that.
> >
> > Ingo
> >
> > ----
> > From: Ingo Molnar <[email protected]>
> >
> > fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to
> > guarantee progress of for_each_sctp_chunk(). (all other uses of
> > for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix
> > should be complete.)
> >
> > Signed-off-by: Ingo Molnar <[email protected]>
> >
> > Index: linux/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
> > ===================================================================
> > --- linux.orig/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
> > +++ linux/net/ipv4/netfilter/ip_conntrack_proto_sctp.c
> > @@ -227,6 +227,15 @@ static int do_basic_checks(struct ip_con
> > flag = 0;
> >
> > for_each_sctp_chunk (skb, sch, _sch, offset, count) {
> > + unsigned int len = (htons(sch->length) + 3) & ~3;
> > +
> > + /*
> > + * Dont get into a loop with zero-sized or negative
> > + * length values:
> > + */
> > + if (!len || len >= skb->len)
> > + goto fail;
> > +
>
> I just came up with a similar fix :) I think I'm going to take my own
> patch though because its IMO slightly nicer. Thanks anyway.
could you send your patch so that i can start using it instead of mine?
Ingo
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]