tree 1f8405f5ab3e74788a6852a0ee2abf35fd546a87
parent 1c980664a2046fa59aeac24467a99bac58d2a740
author Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> 1624907624 -0300
committer Karsten Tausche <karsten@fairphone.com> 1645723883 +0100

sctp: add param size validation for SCTP_PARAM_SET_PRIMARY

commit ef6c8d6ccf0c1dccdda092ebe8782777cd7803c9 upstream.

When SCTP handles an INIT chunk, it calls for example:
sctp_sf_do_5_1B_init
  sctp_verify_init
    sctp_verify_param
  sctp_process_init
    sctp_process_param
      handling of SCTP_PARAM_SET_PRIMARY

sctp_verify_init() wasn't doing proper size validation and neither the
later handling, allowing it to work over the chunk itself, possibly being
uninitialized memory.

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I032230924ead7a03dfb3101e9cd4d48e36bfc616
Issue: FP3SEC-257
(cherry picked from commit 4d2de0d232ee386fceacf7cdb20a6398c3c0854b)