summaryrefslogtreecommitdiff
path: root/net/sctp
diff options
context:
space:
mode:
authorSasha Levin <sasha.levin@oracle.com>2016-01-07 22:52:43 +0300
committerDavid S. Miller <davem@davemloft.net>2016-01-11 02:01:01 +0300
commit320f1a4a175e7cd5d3f006f92b4d4d3e2cbb7bb5 (patch)
tree3028662cc73e52e7c7d5c025f3207dbb9f3fc25a /net/sctp
parent18715b261541f35ccede9b8686ee3ebaac697d38 (diff)
downloadlinux-320f1a4a175e7cd5d3f006f92b4d4d3e2cbb7bb5.tar.xz
net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory
proc_dostring() needs an initialized destination string, while the one provided in proc_sctp_do_hmac_alg() contains stack garbage. Thus, writing to cookie_hmac_alg would strlen() that garbage and end up accessing invalid memory. Fixes: 3c68198e7 ("sctp: Make hmac algorithm selection for cookie generation dynamic") Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp')
-rw-r--r--net/sctp/sysctl.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 26d50c565f54..3e0fc5127225 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -320,7 +320,7 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, int write,
struct ctl_table tbl;
bool changed = false;
char *none = "none";
- char tmp[8];
+ char tmp[8] = {0};
int ret;
memset(&tbl, 0, sizeof(struct ctl_table));