diff options
| author | Wei Yongjun <yjwei@cn.fujitsu.com> | 2007-09-19 17:19:52 +0800 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2007-09-25 22:55:49 -0700 |
| commit | 6f4c618ddb0e6b7e6d49cfc8134e694be1c0bc9b (patch) | |
| tree | 7ff3a0de1fc54e82bca9201d7f3d5df5c43c7cc7 /include/net/sctp/sm.h | |
| parent | 3c77f961b55b6060858c68a213d7f4470d7f3eb2 (diff) | |
| download | kernel_samsung_espresso10-6f4c618ddb0e6b7e6d49cfc8134e694be1c0bc9b.zip kernel_samsung_espresso10-6f4c618ddb0e6b7e6d49cfc8134e694be1c0bc9b.tar.gz kernel_samsung_espresso10-6f4c618ddb0e6b7e6d49cfc8134e694be1c0bc9b.tar.bz2 | |
SCTP : Add paramters validity check for ASCONF chunk
If ADDIP is enabled, when an ASCONF chunk is received with ASCONF
paramter length set to zero, this will cause infinite loop.
By the way, if an malformed ASCONF chunk is received, will cause
processing to access memory without verifying.
This is because of not check the validity of parameters in ASCONF chunk.
This patch fixed this.
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Diffstat (limited to 'include/net/sctp/sm.h')
| -rw-r--r-- | include/net/sctp/sm.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h index cc71f36..e8e3a64 100644 --- a/include/net/sctp/sm.h +++ b/include/net/sctp/sm.h @@ -246,6 +246,9 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *, int, __be16); struct sctp_chunk *sctp_make_asconf_set_prim(struct sctp_association *asoc, union sctp_addr *addr); +int sctp_verify_asconf(const struct sctp_association *asoc, + struct sctp_paramhdr *param_hdr, void *chunk_end, + struct sctp_paramhdr **errp); struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc, struct sctp_chunk *asconf); int sctp_process_asconf_ack(struct sctp_association *asoc, |