From: Vlad Yasevich <vladislav.yasevich@xxxxxx> Date: Fri, 01 Oct 2010 18:13:34 -0400 > On 10/01/2010 05:51 PM, Dan Rosenberg wrote: >> The sctp_asoc_get_hmac() function iterates through a peer's hmac_ids >> array and attempts to ensure that only a supported hmac entry is >> returned. The current code fails to do this properly - if the last id >> in the array is out of range (greater than SCTP_AUTH_HMAC_ID_MAX), the >> id integer remains set after exiting the loop, and the address of an >> out-of-bounds entry will be returned and subsequently used in the >> parent >> function, causing potentially ugly memory corruption. This patch >> resets >> the id integer to 0 on encountering an invalid id so that NULL will be >> returned after finishing the loop if no valid ids are found. >> >> Signed-off-by: Dan Rosenberg<drosenberg@xxxxxxxxxxxxx> > > Good catch. > > Acked-by: Vlad Yasevich <vladislav.yasevich@xxxxxx> Applied. -- To unsubscribe from this list: send the line "unsubscribe linux-sctp" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
