selinux: check length properly in SCTP bind hook

selinux_sctp_bind_connect() must verify if the address buffer has sufficient length before accessing the 'sa_family' field. See __sctp_connect() for a similar check. The length of the whole address ('len') is already checked in the callees. Reported-by: Qian Cai <[email protected]> Fixes: d452930 ("selinux: Add SCTP support") Cc: <[email protected]> # 4.17+ Cc: Richard Haines <[email protected]> Signed-off-by: Ondrej Mosnacek <[email protected]> Tested-by: Qian Cai <[email protected]> Signed-off-by: Paul Moore <[email protected]>
broSysX64 · Nov 13, 2018 · c138325 · c138325
1 parent 4458bba
commit c138325
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
@@ -5318,6 +5318,9 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname,
 	addr_buf = address;
 
 	while (walk_size < addrlen) {
+		if (walk_size + sizeof(sa_family_t) > addrlen)
+			return -EINVAL;
+
 		addr = addr_buf;
 		switch (addr->sa_family) {
 		case AF_UNSPEC: