x25: Validate incoming call user data lengths

X.25 call user data is being copied in its entirety from incoming messages
without consideration to the size of the destination buffers, leading to
possible buffer overflows. Validate incoming call user data lengths before
these copies are performed.

It appears this issue was noticed some time ago, however nothing seemed to
come of it: see http://www.spinics.net/lists/linux-x25/msg00043.html and
commit 8db09f26f912f7c90c764806e804b558da520d4f.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Tested-by: Andrew Hendry <andrew.hendry@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index d30615419b4d77c1c375302f28c64034144b9385..a4bd1720e39b9047fa59612064de8e3a054dc6a4 100644 (file)
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -958,6 +958,12 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
                goto out_clear_request;
        skb_pull(skb,len);
 
+       /*
+        *      Ensure that the amount of call user data is valid.
+        */
+       if (skb->len > X25_MAX_CUD_LEN)
+               goto out_clear_request;
+
        /*
         *      Find a listener for the particular address/cud pair.
         */

diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 0b073b51b183a0b78fdd7e766ce015cf24043e1e..63488fd4885a75814c94450b8589017008195afb 100644 (file)
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -127,6 +127,9 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                 *      Copy any Call User Data.
                 */
                if (skb->len > 0) {
+                       if (skb->len > X25_MAX_CUD_LEN)
+                               goto out_clear;
+
                        skb_copy_from_linear_data(skb,
                                                  x25->calluserdata.cuddata,
                                                  skb->len);