summaryrefslogtreecommitdiffstats
path: root/net/sctp/auth.c
diff options
context:
space:
mode:
authorVlad Yasevich <vladislav.yasevich@hp.com>2008-08-27 16:09:49 -0700
committerDavid S. Miller <davem@davemloft.net>2008-08-27 16:09:49 -0700
commitd97240552cd98c4b07322f30f66fd9c3ba4171de (patch)
tree61a8fd1ace711bcf2c832d0c453d8fbf6f8f3003 /net/sctp/auth.c
parent328fc47ea0bcc27d9afa69c3ad6e52431cadd76c (diff)
downloadlinux-d97240552cd98c4b07322f30f66fd9c3ba4171de.tar.gz
linux-d97240552cd98c4b07322f30f66fd9c3ba4171de.tar.bz2
linux-d97240552cd98c4b07322f30f66fd9c3ba4171de.zip
sctp: fix random memory dereference with SCTP_HMAC_IDENT option.
The number of identifiers needs to be checked against the option length. Also, the identifier index provided needs to be verified to make sure that it doesn't exceed the bounds of the array. Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp/auth.c')
-rw-r--r--net/sctp/auth.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 1fcb4cf2f4c9..52db5f60daa0 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -786,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
for (i = 0; i < hmacs->shmac_num_idents; i++) {
id = hmacs->shmac_idents[i];
+ if (id > SCTP_AUTH_HMAC_ID_MAX)
+ return -EOPNOTSUPP;
+
if (SCTP_AUTH_HMAC_ID_SHA1 == id)
has_sha1 = 1;