Bug 224103 - A possible out of bounds of memory in netinet/libalias/alias_sctp.c.
Summary: A possible out of bounds of memory in netinet/libalias/alias_sctp.c.
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Michael Tuexen
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-12-05 07:14 UTC by logwang
Modified: 2018-04-08 16:30 UTC (History)
1 user (show)

See Also:
tuexen: mfc-stable11+
tuexen: mfc-stable10+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description logwang 2017-12-05 07:14:38 UTC 
In AliasSctpInit():
    la->sctpNatTimer.TimerQ = sn_calloc(SN_TIMER_QUEUE_SIZE, sizeof(struct sctpTimerQ));

since SN_TIMER_QUEUE_SIZE is defined as SN_MAX_TIMER+2, and sn_calloc is defined as sn_malloc(x * n) if _SYS_MALLOC_H_ is defined, the size of calloced memory will be wrong, because the macro will be expanded to SN_MAX_TIMER+2*sizeof(struct sctpTimerQ).

This was found when i compiled the code on Linux, i don't know whether it's a problem or not if compiled on FreeBSD system.
Comment 1 logwang 2017-12-05 07:17:58 UTC 
(In reply to logwang from comment #0)
a description mistake:
sn_calloc will be expanded to sizeof(struct sctpTimerQ)*SN_MAX_TIMER+2
Comment 2 commit-hook freebsd_committer freebsd_triage 2017-12-26 14:38:25 UTC 
A commit references this bug:

Author: tuexen
Date: Tue Dec 26 14:37:48 UTC 2017
New revision: 327203
URL: https://svnweb.freebsd.org/changeset/base/327203

Log:
  Allow the first (and second) argument of sn_calloc() be a sum.
  This fixes a bug reported in
  https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224103
  PR:		224103

Changes:
  head/sys/netinet/libalias/alias_sctp.c
Comment 3 commit-hook freebsd_committer freebsd_triage 2018-04-08 14:09:43 UTC 
A commit references this bug:

Author: tuexen
Date: Sun Apr  8 14:09:27 UTC 2018
New revision: 332276
URL: https://svnweb.freebsd.org/changeset/base/332276

Log:
  MFC r327203:

  Allow the first (and second) argument of sn_calloc() be a sum.
  This fixes a bug reported in
  https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224103

  PR:		224103

Changes:
_U  stable/11/
  stable/11/sys/netinet/libalias/alias_sctp.c
Comment 4 commit-hook freebsd_committer freebsd_triage 2018-04-08 16:25:37 UTC 
A commit references this bug:

Author: tuexen
Date: Sun Apr  8 16:24:37 UTC 2018
New revision: 332282
URL: https://svnweb.freebsd.org/changeset/base/332282

Log:
  MFC r327203:

  Allow the first (and second) argument of sn_calloc() be a sum.
  This fixes a bug reported in
  https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224103

  PR:		224103

Changes:
_U  stable/10/
  stable/10/sys/netinet/libalias/alias_sctp.c