diff options
author | Eric Biggers <ebiggers@google.com> | 2017-12-30 03:15:23 +0300 |
---|---|---|
committer | Steffen Klassert <steffen.klassert@secunet.com> | 2017-12-30 11:52:08 +0300 |
commit | 4e765b4972af7b07adcb1feb16e7a525ce1f6b28 (patch) | |
tree | 6aca6a9e625a700198c17a89da9190c7d36f0d2f /Kbuild | |
parent | 06b335cb51af018d5feeff5dd4fd53847ddb675a (diff) | |
download | linux-4e765b4972af7b07adcb1feb16e7a525ce1f6b28.tar.xz |
af_key: fix buffer overread in parse_exthdrs()
If a message sent to a PF_KEY socket ended with an incomplete extension
header (fewer than 4 bytes remaining), then parse_exthdrs() read past
the end of the message, into uninitialized memory. Fix it by returning
-EINVAL in this case.
Reproducer:
#include <linux/pfkeyv2.h>
#include <sys/socket.h>
#include <unistd.h>
int main()
{
int sock = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
char buf[17] = { 0 };
struct sadb_msg *msg = (void *)buf;
msg->sadb_msg_version = PF_KEY_V2;
msg->sadb_msg_type = SADB_DELETE;
msg->sadb_msg_len = 2;
write(sock, buf, 17);
}
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'Kbuild')
0 files changed, 0 insertions, 0 deletions