Full Disclosure mailing list archives
Re: Re: Linux Kernel sctp_setsockopt() Integer Overflow
From: Stefan Esser <s.esser () e-matters de>
Date: Sun, 16 May 2004 00:08:50 +0200
How did you come from the above snippet of the code to the idea that kmalloc(0) returns NULL?
Doesn't matter: the first thing linux's sys_setsockopt() does is checking if optlen is < 0. It will fail in this case. So the needed optlen is never handled down to the protocol setsockopt function. Otherwise you would find several protocol handlers vulnerable... f.e. IPv6... Stefan Esser -- -------------------------------------------------------------------------- Stefan Esser s.esser () e-matters de e-matters Security http://security.e-matters.de/ GPG-Key gpg --keyserver pgp.mit.edu --recv-key 0xCF6CAE69 Key fingerprint B418 B290 ACC0 C8E5 8292 8B72 D6B0 7704 CF6C AE69 -------------------------------------------------------------------------- Did I help you? Consider a gift: http://wishlist.suspekt.org/ -------------------------------------------------------------------------- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Linux Kernel sctp_setsockopt() Integer Overflow Shaun Colley (May 11)
- Re: Linux Kernel sctp_setsockopt() Integer Overflow Tom Rini (May 11)
- Re: Linux Kernel sctp_setsockopt() Integer Overflow Stefan Esser (May 11)
- Re: Linux Kernel sctp_setsockopt() Integer Overflow Michael Tokarev (May 15)
- Re: Re: Linux Kernel sctp_setsockopt() Integer Overflow Jirka Kosina (May 15)
- Re: Re: Linux Kernel sctp_setsockopt() Integer Overflow Stefan Esser (May 15)
- Re: Linux Kernel sctp_setsockopt() Integer Overflow Evgeny Demidov (May 15)
- Re: Linux Kernel sctp_setsockopt() Integer Overflow Michael Tokarev (May 27)
- Re: Linux Kernel sctp_setsockopt() Integer Overflow Jirka Kosina (May 28)
- Re: Linux Kernel sctp_setsockopt() Integer Overflow Michael Tokarev (May 28)
- Re: Linux Kernel sctp_setsockopt() Integer Overflow Michael Tokarev (May 28)
- Re: Linux Kernel sctp_setsockopt() Integer Overflow Michael Tokarev (May 28)
- Re: Re: Linux Kernel sctp_setsockopt() Integer Overflow Jirka Kosina (May 15)