linux/net/sctp
Xi Wang c89304b8ea sctp: better integer overflow check in sctp_auth_create_key()
The check from commit 30c2235c is incomplete and cannot prevent
cases like key_len = 0x80000000 (INT_MAX + 1).  In that case, the
left-hand side of the check (INT_MAX - key_len), which is unsigned,
becomes 0xffffffff (UINT_MAX) and bypasses the check.

However this shouldn't be a security issue.  The function is called
from the following two code paths:

 1) setsockopt()

 2) sctp_auth_asoc_set_secret()

In case (1), sca_keylength is never going to exceed 65535 since it's
bounded by a u16 from the user API.  As such, the key length will
never overflow.

In case (2), sca_keylength is computed based on the user key (1 short)
and 2 * key_vector (3 shorts) for a total of 7 * USHRT_MAX, which still
will not overflow.

In other words, this overflow check is not really necessary.  Just
make it more correct.

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Cc: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-11-29 15:51:03 -05:00
..
associola.c sctp: Bundle HEAERTBEAT into ASCONF_ACK 2011-08-24 19:41:13 -07:00
auth.c sctp: better integer overflow check in sctp_auth_create_key() 2011-11-29 15:51:03 -05:00
bind_addr.c net: Remove casts of void * 2011-06-16 23:19:27 -04:00
chunk.c net/sctp: Use pr_fmt and pr_<level> 2010-08-26 14:11:48 -07:00
command.c [SCTP]: Remove sctp_add_cmd_sf wrapper bloat 2008-03-27 17:54:29 -07:00
debug.c sctp: remove completely unsed EMPTY state 2011-04-20 01:51:03 -07:00
endpointola.c sctp: bail from sctp_endpoint_lookup_assoc() if not bound 2011-04-20 01:51:03 -07:00
input.c net: Remove casts of void * 2011-06-16 23:19:27 -04:00
inqueue.c net/sctp: Use pr_fmt and pr_<level> 2010-08-26 14:11:48 -07:00
ipv6.c ipv6: tcp: fix TCLASS value in ACK messages sent from TIME_WAIT 2011-10-27 00:44:35 -04:00
Kconfig sctp: implement sctp association probing module 2010-04-30 22:41:09 -04:00
Makefile sctp: implement sctp association probing module 2010-04-30 22:41:09 -04:00
objcnt.c net/sctp: Use pr_fmt and pr_<level> 2010-08-26 14:11:48 -07:00
output.c net: sctp: fix checksum marking for outgoing packets 2011-07-14 15:16:31 -07:00
outqueue.c sctp: HEARTBEAT negotiation after ASCONF 2011-08-24 19:41:09 -07:00
primitive.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
probe.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6 2010-10-23 11:47:02 -07:00
proc.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
protocol.c net: more accurate skb truesize 2011-10-13 16:05:07 -04:00
sm_make_chunk.c sctp: Bundle HEAERTBEAT into ASCONF_ACK 2011-08-24 19:41:13 -07:00
sm_sideeffect.c sctp: deal with multiple COOKIE_ECHO chunks 2011-09-16 17:17:22 -04:00
sm_statefuns.c Merge branch 'master' of github.com:davem330/net 2011-09-22 03:23:13 -04:00
sm_statetable.c sctp: Enforce retransmission limit during shutdown 2011-07-07 14:08:44 -07:00
socket.c net: Add export.h for EXPORT_SYMBOL/THIS_MODULE to non-modules 2011-10-31 19:30:30 -04:00
ssnmap.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
sysctl.c sctp: Add sysctl support for Auto-ASCONF. 2011-06-02 02:04:53 -07:00
transport.c sctp: Store a flowi in transports to provide persistent keying. 2011-05-08 14:05:14 -07:00
tsnmap.c sctp: fix compile warnings in sctp_tsnmap_num_gabs 2011-02-20 11:10:15 -08:00
ulpevent.c sctp: ABORT if receive, reassmbly, or reodering queue is not empty while closing socket 2011-07-08 09:53:08 -07:00
ulpqueue.c Fix common misspellings 2011-03-31 11:26:23 -03:00