sctp: Make sure N * sizeof(union sctp_addr) does not overflow.
David S. Miller authored
commit 735ce972

 upstream

As noticed by Gabriel Campana, the kmalloc() length arg
passed in by sctp_getsockopt_local_addrs_old() can overflow
if ->addr_num is large enough.

Therefore, enforce an appropriate limit.
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
bd3aae04
Name Last commit Last update
..
Kconfig [SCTP]: Use crc32c library for checksum calculations.
Makefile [SCTP]: Use crc32c library for checksum calculations.
associola.c [SCTP]: Fix kernel panic while received ASCONF chunk with bad serial number
auth.c [SCTP]: Update AUTH structures to match declarations in draft-16.
bind_addr.c [SCTP]: Fix local_addr deletions during list traversals.
chunk.c [SCTP]: Stop claiming that this is a "reference implementation"
command.c [SCTP]: Stop claiming that this is a "reference implementation"
debug.c [SCTP]: Stop claiming that this is a "reference implementation"
endpointola.c [SCTP]: Stop claiming that this is a "reference implementation"
input.c [SCTP]: fix misannotated __sctp_rcv_asconf_lookup()
inqueue.c [SCTP]: Stop claiming that this is a "reference implementation"
ipv6.c [SCTP]: IPv4 vs IPv6 addresses mess in sctp_inet[6]addr_event.
objcnt.c [SCTP]: Use proc_create() to setup ->proc_fops first
output.c [SCTP]: Stop claiming that this is a "reference implementation"
outqueue.c [SCTP]: Fix protocol violation when receiving an error lenght INIT-ACK
primitive.c [SCTP]: Stop claiming that this is a "reference implementation"
proc.c [SCTP]: Use proc_create to setup de->proc_fops.
protocol.c [SCTP]: IPv4 vs IPv6 addresses mess in sctp_inet[6]addr_event.
sm_make_chunk.c [SCTP]: Add check for hmac_algo parameter in sctp_verify_param()
sm_sideeffect.c [SCTP]: Fix protocol violation when receiving an error lenght INIT-ACK
sm_statefuns.c [SCTP]: Fix compiler warning about const qualifiers
sm_statetable.c [SCTP]: Stop claiming that this is a "reference implementation"
socket.c sctp: Make sure N * sizeof(union sctp_addr) does not overflow.
ssnmap.c [SCTP]: Stop claiming that this is a "reference implementation"
sysctl.c [SCTP]: Stop claiming that this is a "reference implementation"
transport.c [SCTP]: Stop claiming that this is a "reference implementation"
tsnmap.c [SCTP]: Stop claiming that this is a "reference implementation"
ulpevent.c [SCTP]: Fix compiler warning about const qualifiers
ulpqueue.c [SCTP]: Correctly reap SSNs when processing FORWARD_TSN chunk