diff options
author | Chris Wright <chrisw@sous-sol.org> | 2008-06-04 09:16:33 -0700 |
---|---|---|
committer | Willy Tarreau <w@1wt.eu> | 2008-07-20 18:25:47 +0200 |
commit | 603a90fa464a4097753c28ed12bcdd9e5f5d666a (patch) | |
tree | 7e91d0191794c16b9415fcb7dc98eebb05ebbec3 | |
parent | 3a95e8e646a1c0a4a83cb6ea4fdeb5d711c4add6 (diff) | |
download | linux-2.4-603a90fa464a4097753c28ed12bcdd9e5f5d666a.tar.gz |
asn1: additional sanity checking during BER decoding (CVE-2008-1673)
[backport of 2.6 commit ddb2c43594f22843e9f3153da151deaba1a834c5]
- Don't trust a length which is greater than the working buffer.
An invalid length could cause overflow when calculating buffer size
for decoding oid.
- An oid length of zero is invalid and allows for an off-by-one error when
decoding oid because the first subid actually encodes first 2 subids.
- A primitive encoding may not have an indefinite length.
Thanks to Wei Wang from McAfee for report.
Cc: Steven French <sfrench@us.ibm.com>
Cc: stable@kernel.org
Acked-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[w@1wt.eu: backported to 2.4 : no cifs ; snmp in ip_nat_snmp_basic.c]
Signed-off-by: Willy Tarreau <w@1wt.eu>
-rw-r--r-- | net/ipv4/netfilter/ip_nat_snmp_basic.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c index efc651c675c183..87d71d4aed501f 100644 --- a/net/ipv4/netfilter/ip_nat_snmp_basic.c +++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c @@ -232,6 +232,11 @@ static unsigned char asn1_length_decode(struct asn1_ctx *ctx, } } } + + /* don't trust len bigger than ctx buffer */ + if (*len > ctx->end - ctx->pointer) + return 0; + return 1; } @@ -248,7 +253,11 @@ static unsigned char asn1_header_decode(struct asn1_ctx *ctx, if (!asn1_length_decode(ctx, &def, &len)) return 0; - + + /* primitive shall be definite, indefinite shall be constructed */ + if (*con == ASN1_PRI && !def) + return 0; + if (def) *eoc = ctx->pointer + len; else @@ -433,6 +442,11 @@ static unsigned char asn1_oid_decode(struct asn1_ctx *ctx, unsigned long *optr; size = eoc - ctx->pointer + 1; + + /* first subid actually encodes first two subids */ + if (size < 2 || size > ULONG_MAX/sizeof(unsigned long)) + return 0; + *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC); if (*oid == NULL) { if (net_ratelimit()) |