GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-04-14 18:34:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[NETFILTER] SCTP conntrack: fix infinite loop

Browse source 
fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to
guarantee progress of for_each_sctp_chunk(). (all other uses of
for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix
should be complete.)

Based on patch from Ingo Molnar <mingo@elte.hu>

CVE-2006-1527

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Patrick McHardy 2006-05-02 23:23:07 +02:00 • committed by Linus Torvalds
parent ebf34c9b6f
commit e17df688f7
2 changed files with 14 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
net/ipv4/netfilter/ip_conntrack_proto_sctp.c
View file

@ -235,12 +235,15 @@ static int do_basic_checks(struct ip_conntrack *conntrack,
flag = 1; flag = 1;
} }
/* Cookie Ack/Echo chunks not the first OR /*
Init / Init Ack / Shutdown compl chunks not the only chunks */ * Cookie Ack/Echo chunks not the first OR
if ((sch->type == SCTP_CID_COOKIE_ACK * Init / Init Ack / Shutdown compl chunks not the only chunks
* OR zero-length.
*/
if (((sch->type == SCTP_CID_COOKIE_ACK
|| sch->type == SCTP_CID_COOKIE_ECHO || sch->type == SCTP_CID_COOKIE_ECHO
|| flag) || flag)
&& count !=0 ) { && count !=0) || !sch->length) {
DEBUGP("Basic checks failed\n"); DEBUGP("Basic checks failed\n");
return 1; return 1;
} }

11
net/netfilter/nf_conntrack_proto_sctp.c
View file

@ -240,12 +240,15 @@ static int do_basic_checks(struct nf_conn *conntrack,
flag = 1; flag = 1;
} }
/* Cookie Ack/Echo chunks not the first OR /*
Init / Init Ack / Shutdown compl chunks not the only chunks */ * Cookie Ack/Echo chunks not the first OR
if ((sch->type == SCTP_CID_COOKIE_ACK * Init / Init Ack / Shutdown compl chunks not the only chunks
* OR zero-length.
*/
if (((sch->type == SCTP_CID_COOKIE_ACK
|| sch->type == SCTP_CID_COOKIE_ECHO || sch->type == SCTP_CID_COOKIE_ECHO
|| flag) || flag)
&& count !=0 ) { && count !=0) || !sch->length) {
DEBUGP("Basic checks failed\n"); DEBUGP("Basic checks failed\n");
return 1; return 1;
} }