* [PATCH v2] irda: prevent heap corruption on invalid nickname
@ 2011-03-20 6:14 Dan Rosenberg
2011-03-28 0:59 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dan Rosenberg @ 2011-03-20 6:14 UTC (permalink / raw)
To: samuel, davem; +Cc: netdev, security
Invalid nicknames containing only spaces will result in an underflow in
a memcpy size calculation, subsequently destroying the heap and
panicking.
v2 also catches the case where the provided nickname is longer than the
buffer size, which can result in controllable heap corruption.
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
---
net/irda/irnet/irnet_ppp.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 7c567b8..2bb2beb 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -105,6 +105,9 @@ irnet_ctrl_write(irnet_socket * ap,
while(isspace(start[length - 1]))
length--;
+ DABORT(length < 5 || length > NICKNAME_MAX_LEN + 5,
+ -EINVAL, CTRL_ERROR, "Invalid nickname.\n");
+
/* Copy the name for later reuse */
memcpy(ap->rname, start + 5, length - 5);
ap->rname[length - 5] = '\0';
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] irda: prevent heap corruption on invalid nickname
2011-03-20 6:14 [PATCH v2] irda: prevent heap corruption on invalid nickname Dan Rosenberg
@ 2011-03-28 0:59 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2011-03-28 0:59 UTC (permalink / raw)
To: drosenberg; +Cc: samuel, netdev, security
From: Dan Rosenberg <drosenberg@vsecurity.com>
Date: Sun, 20 Mar 2011 02:14:30 -0400
> Invalid nicknames containing only spaces will result in an underflow in
> a memcpy size calculation, subsequently destroying the heap and
> panicking.
>
> v2 also catches the case where the provided nickname is longer than the
> buffer size, which can result in controllable heap corruption.
>
> Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
> Cc: stable@kernel.org
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-03-28 0:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-03-20 6:14 [PATCH v2] irda: prevent heap corruption on invalid nickname Dan Rosenberg
2011-03-28 0:59 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).