Re: [PATCH 3/3] x25: Prevent skb overreads when checking call user data

[Andrew Hendry <andrew.hendry@gmail.com>]

Acked-by: Andrew Hendry <andrew.hendry@gmail.com>

On Sat, Oct 15, 2011 at 3:45 PM, Matthew Daley <mattjd@gmail.com> wrote:
> x25_find_listener does not check that the amount of call user data given
> in the skb is big enough in per-socket comparisons, hence buffer
> overreads may occur.  Fix this by adding a check.
>
> Signed-off-by: Matthew Daley <mattjd@gmail.com>
> Cc: Eric Dumazet <eric.dumazet@gmail.com>
> Cc: Andrew Hendry <andrew.hendry@gmail.com>
> Cc: stable <stable@kernel.org>
> ---
>  net/x25/af_x25.c |    3 ++-
>  1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
> index aa567b0..5f03e4e 100644
> --- a/net/x25/af_x25.c
> +++ b/net/x25/af_x25.c
> @@ -295,7 +295,8 @@ static struct sock *x25_find_listener(struct x25_address *addr,
>                         * Found a listening socket, now check the incoming
>                         * call user data vs this sockets call user data
>                         */
> -                       if(skb->len > 0 && x25_sk(s)->cudmatchlength > 0) {
> +                       if (x25_sk(s)->cudmatchlength > 0 &&
> +                               skb->len >= x25_sk(s)->cudmatchlength) {
>                                if((memcmp(x25_sk(s)->calluserdata.cuddata,
>                                        skb->data,
>                                        x25_sk(s)->cudmatchlength)) == 0) {
> --
> 1.7.2.5
>
>