tree bb2ad3e16dae763afbfc21b82a3ab47c736ea6a5
parent 473cea4983b582fedb10f84b43e8924716ebc4fc
author Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> 1624907623 -0300
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1632658136 +0200

sctp: validate chunk size in __rcv_asconf_lookup

commit b6ffe7671b24689c09faa5675dd58f93758a97ae upstream.

In one of the fallbacks that SCTP has for identifying an association for an
incoming packet, it looks for AddIp chunk (from ASCONF) and take a peek.
Thing is, at this stage nothing was validating that the chunk actually had
enough content for that, allowing the peek to happen over uninitialized
memory.

Similar check already exists in actual asconf handling in
sctp_verify_asconf().

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>