memory corruption in X.25 facilities parsing, CVE-2010-3873
 

BugLink: http://bugs.launchpad.net/bugs/709372

CVE-2010-3873

Partial backport from a6331d6f9a4298173b413cf99a40cc86a9d92c37
by Tim Gardner <tim.gardner@canonical.com>

Signed-of-by: Andrew Hendry <andrew.hendry@gmail.com>

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
net/x25/x25_in.c | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 2614687..659252b 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -90,6 +90,7 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
switch (frametype) {
case X25_CALL_ACCEPTED: {
struct x25_sock *x25 = x25_sk(sk);
+ int len;

x25_stop_timer(sk);
x25->condition = 0x00;
@@ -104,9 +105,12 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
*/
skb_pull(skb, X25_STD_MIN_LEN);
skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr));
- skb_pull(skb,
- x25_parse_facilities(skb, &x25->facilities,
- &x25->vc_facil_mask));
+ len = x25_parse_facilities(skb, &x25->facilities,
+ &x25->vc_facil_mask);
+ if (len <= 0)
+ return -1;
+ skb_pull(skb, len);
+
/*
* Copy any Call User Data.
*/
--
1.7.0.4


--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team