diff options
| author | Dan Rosenberg <[email protected]> | 2010-10-01 11:16:58 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2010-10-04 04:58:48 +0000 |
| commit | d7e0d19aa0fdd22819d35db551bd54c1bcf9c2aa (patch) | |
| tree | 3abc10f8a6e3f296fb619077af5f6f16713c62b8 /net/ipv4/tcp_timer.c | |
| parent | ipv4: correct IGMP behavior on v3 query during v2-compatibility mode (diff) | |
| download | kernel-d7e0d19aa0fdd22819d35db551bd54c1bcf9c2aa.tar.gz kernel-d7e0d19aa0fdd22819d35db551bd54c1bcf9c2aa.zip | |
sctp: prevent reading out-of-bounds memory
Two user-controlled allocations in SCTP are subsequently dereferenced as
sockaddr structs, without checking if the dereferenced struct members fall
beyond the end of the allocated chunk. There doesn't appear to be any
information leakage here based on how these members are used and
additional checking, but it's still worth fixing.
[[email protected]: remove unfashionable newlines, fix gmail tab->space conversion]
Signed-off-by: Dan Rosenberg <[email protected]>
Acked-by: Vlad Yasevich <[email protected]>
Cc: David Miller <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'net/ipv4/tcp_timer.c')
0 files changed, 0 insertions, 0 deletions