svn commit: r364578 - stable/12/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Sun Aug 23 22:35:52 2020
New Revision: 364578
URL: https://svnweb.freebsd.org/changeset/base/364578

Log:
  MFC r360209:
  Improve input validation when processing AUTH chunks.
  
  Thanks to Natalie Silvanovich from Google for finding and reporting the
  issue found by her in the SCTP userland stack.

Modified:
  stable/12/sys/netinet/sctp_input.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/sctp_input.c
==============================================================================
--- stable/12/sys/netinet/sctp_input.c	Sun Aug 23 22:34:15 2020	(r364577)
+++ stable/12/sys/netinet/sctp_input.c	Sun Aug 23 22:35:52 2020	(r364578)
@@ -2094,7 +2094,7 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, in
 	int init_offset, initack_offset, initack_limit;
 	int retval;
 	int error = 0;
-	uint8_t auth_chunk_buf[SCTP_PARAM_BUFFER_SIZE];
+	uint8_t auth_chunk_buf[SCTP_CHUNK_BUFFER_SIZE];
 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
 	struct socket *so;
 
@@ -2273,7 +2273,7 @@ sctp_process_cookie_new(struct mbuf *m, int iphlen, in
 	if (auth_skipped) {
 		struct sctp_auth_chunk *auth;
 
-		if (auth_len <= SCTP_PARAM_BUFFER_SIZE) {
+		if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
 			auth = (struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, auth_chunk_buf);
 		} else {
 			auth = NULL;
@@ -4670,11 +4670,13 @@ sctp_process_control(struct mbuf *m, int iphlen, int *
 			if (auth_skipped && (stcb != NULL)) {
 				struct sctp_auth_chunk *auth;
 
-				auth = (struct sctp_auth_chunk *)
-				    sctp_m_getptr(m, auth_offset,
-				    auth_len, chunk_buf);
-				got_auth = 1;
-				auth_skipped = 0;
+				if (auth_len <= SCTP_CHUNK_BUFFER_SIZE) {
+					auth = (struct sctp_auth_chunk *)sctp_m_getptr(m, auth_offset, auth_len, chunk_buf);
+					got_auth = 1;
+					auth_skipped = 0;
+				} else {
+					auth = NULL;
+				}
 				if ((auth == NULL) || sctp_handle_auth(stcb, auth, m,
 				    auth_offset)) {
 					/* auth HMAC failed so dump it */