Messages in this thread | | | Date | Tue, 24 Mar 2015 17:11:12 +0800 | From | Ying Xue <> | Subject | Re: [PATCH] tipc: validate length of sockaddr in connect() for dgram/rdm |
| |
On 03/24/2015 03:30 AM, Sasha Levin wrote: > Commit f2f8036 ("tipc: add support for connect() on dgram/rdm sockets") > hasn't validated user input length for the sockaddr structure which allows > a user to overwrite kernel memory with arbitrary input. > > Fixes: f2f8036 ("tipc: add support for connect() on dgram/rdm sockets") > Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
> --- > net/tipc/socket.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/net/tipc/socket.c b/net/tipc/socket.c > index 73c2f51..986dc96 100644 > --- a/net/tipc/socket.c > +++ b/net/tipc/socket.c > @@ -1852,6 +1852,8 @@ static int tipc_connect(struct socket *sock, struct sockaddr *dest, > if (dst->family == AF_UNSPEC) { > memset(&tsk->remote, 0, sizeof(struct sockaddr_tipc)); > tsk->connected = 0; > + } else if (destlen != sizeof(struct sockaddr_tipc)) { > + res = -EINVAL; > } else { > memcpy(&tsk->remote, dest, destlen); > tsk->connected = 1; >
| |