* Minor bugs in sctp_getsockopt()
@ 2020-05-20 14:57 David Laight
0 siblings, 0 replies; only message in thread
From: David Laight @ 2020-05-20 14:57 UTC (permalink / raw)
To: netdev@vger.kernel.org, linux-sctp@vger.kernel.org,
'Marcelo Ricardo Leitner', Neil Horman
I've found 2 minor bugs in sctp_getsockopt().
sctp_getsockopt_peer_auth_chunks() fails to allow for the header
structure when checking the length of the user buffer.
So it can write beyond the end of the user buffer.
sctp_getsockopt_pr_streamstatus() fails to do the copy_to_user()
when streamoute is NULL.
I found these in the middle of writing another patch.
So generating the patch is tricky.
David
-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-05-20 14:57 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-05-20 14:57 Minor bugs in sctp_getsockopt() David Laight
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).