• andrew hendry's avatar
    x25: possible skb leak on bad facilities · 95c30430
    andrew hendry authored
    Originally x25_parse_facilities returned
    -1 for an error
     0 meaning 0 length facilities
    >0 the length of the facilities parsed.
    
    5ef41308 ("x25: Prevent crashing when parsing bad X.25 facilities") introduced more
    error checking in x25_parse_facilities however used 0 to indicate bad parsing
    a6331d6f ("memory corruption in X.25 facilities parsing") followed this further for
    DTE facilities, again using 0 for bad parsing.
    
    The meaning of 0 got confused in the callers.
    If the facilities are messed up we can't determine where the data starts.
    So patch makes all parsing errors return -1 and ensures callers close and don't use the skb further.
    Reported-by: default avatarAndy Whitcroft <apw@canonical.com>
    Signed-off-by: default avatarAndrew Hendry <andrew.hendry@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    95c30430
x25_facilities.c 8.97 KB