Linux 2.6.17.1

[PATCH] xt_sctp: fix endless loop caused by 0 chunk length (CVE-2006-3085)
Fix endless loop in the SCTP match similar to those already fixed in the SCTP conntrack helper (was CVE-2006-1527). Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Chris Wright <chrisw@sous-sol.org>
2006-06-20 02:31:55 -07:00 · 2006-06-20 02:31:42 -07:00
2 changed files with 2 additions and 2 deletions
--- a/2
+++ b/2
@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 17
-EXTRAVERSION =
+EXTRAVERSION = .1
 NAME=Crazed Snow-Weasel

 # *DOCUMENTATION*
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@ -62,7 +62,7 @@ match_packet(const struct sk_buff *skb,

 	do {
 		sch = skb_header_pointer(skb, offset, sizeof(_sch), &_sch);
-		if (sch == NULL) {
+		if (sch == NULL || sch->length == 0) {
 			duprintf("Dropping invalid SCTP packet.\n");
 			*hotdrop = 1;
 			return 0;