This repository has been archived on 2022-02-17. You can view files and clone it, but cannot push or open issues or pull requests.

Xi Wang c89304b8ea sctp: better integer overflow check in sctp_auth_create_key() ... The check from commit 30c2235c is incomplete and cannot prevent cases like key_len = 0x80000000 (INT_MAX + 1). In that case, the left-hand side of the check (INT_MAX - key_len), which is unsigned, becomes 0xffffffff (UINT_MAX) and bypasses the check. However this shouldn't be a security issue. The function is called from the following two code paths: 1) setsockopt() 2) sctp_auth_asoc_set_secret() In case (1), sca_keylength is never going to exceed 65535 since it's bounded by a u16 from the user API. As such, the key length will never overflow. In case (2), sca_keylength is computed based on the user key (1 short) and 2 * key_vector (3 shorts) for a total of 7 * USHRT_MAX, which still will not overflow. In other words, this overflow check is not really necessary. Just make it more correct. Signed-off-by: Xi Wang <xi.wang@gmail.com> Cc: Vlad Yasevich <vladislav.yasevich@hp.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2011-11-29 15:51:03 -05:00
..
Kconfig	…
Makefile	…
associola.c	…
auth.c	sctp: better integer overflow check in sctp_auth_create_key()	2011-11-29 15:51:03 -05:00
bind_addr.c	…
chunk.c	…
command.c	…
debug.c	…
endpointola.c	…
input.c	…
inqueue.c	…
ipv6.c	ipv6: tcp: fix TCLASS value in ACK messages sent from TIME_WAIT	2011-10-27 00:44:35 -04:00
objcnt.c	…
output.c	…
outqueue.c	…
primitive.c	…
probe.c	…
proc.c	net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules	2011-10-31 19:30:30 -04:00
protocol.c	net: more accurate skb truesize	2011-10-13 16:05:07 -04:00
sm_make_chunk.c	…
sm_sideeffect.c	…
sm_statefuns.c	…
sm_statetable.c	…
socket.c	net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules	2011-10-31 19:30:30 -04:00
ssnmap.c	…
sysctl.c	…
transport.c	…
tsnmap.c	…
ulpevent.c	…
ulpqueue.c	…