Improve input validation for parameters in ASCONF and ASCONF-ACK chunks
Thanks to Tolya Korniltsev for drawing my attention to this part of the
code by reporting an issue for the userland stack.
#if defined(__FreeBSD__) && !defined(__Userspace__)
#include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_asconf.c 365071 2020-09-01 21:19:14Z mjg $");
+__FBSDID("$FreeBSD$");
#endif
#include <netinet/sctp_os.h>
@@ -737,7 +737,7 @@ sctp_handle_asconf(struct mbuf *m, unsigned int offset,
sctp_m_freem(m_ack);
return;
}
- if (param_length <= sizeof(struct sctp_paramhdr)) {
+ if (param_length < sizeof(struct sctp_asconf_paramhdr)) {
SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
sctp_m_freem(m_ack);
return;
@@ -1777,7 +1777,7 @@ sctp_handle_asconf_ack(struct mbuf *m, int offset,
sctp_asconf_ack_clear(stcb);
return;
}
- if (param_length < sizeof(struct sctp_paramhdr)) {
+ if (param_length < sizeof(struct sctp_asconf_paramhdr)) {
sctp_asconf_ack_clear(stcb);
return;
}
