x25: Validate incoming call user data lengths

commit c7fd0d48bde943e228e9c28ce971a22d6a1744c4 upstream.

X.25 call user data is being copied in its entirety from incoming messages
without consideration to the size of the destination buffers, leading to
possible buffer overflows. Validate incoming call user data lengths before
these copies are performed.

It appears this issue was noticed some time ago, however nothing seemed to
come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and
commit 8db09f26f912f7c90c764806e804b558da520d4f.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Andrew Hendry <andrew.hendry@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 373e14f21a17820fad0f4c64135421b3a9c0fb44..8c0346f00e6819c49e1b7ec9a49260a7de9556ca 100644 (file)
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -959,6 +959,12 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
                goto out_clear_request;
        skb_pull(skb,len);
 
+       /*
+        *      Ensure that the amount of call user data is valid.
+        */
+       if (skb->len > X25_MAX_CUD_LEN)
+               goto out_clear_request;
+
        /*
         *      Find a listener for the particular address/cud pair.
         */

diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 15de65f04719976b15dc351a03854d46076d7880..b1180cc2866994d3b853d828b073469cf63ca9d5 100644 (file)
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -127,6 +127,9 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                         *      Copy any Call User Data.
                         */
                        if (skb->len > 0) {
+                               if (skb->len > X25_MAX_CUD_LEN)
+                                       goto out_clear;
+
                                skb_copy_from_linear_data(skb,
                                              x25->calluserdata.cuddata,
                                              skb->len);