From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 21 Feb 2019 12:36:43 +0000 (+0100)
Subject: 4.20-stable patches
X-Git-Tag: v3.18.136~10
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8ee26036e5dd64978f58906980d5346d56f1757d;p=thirdparty%2Fkernel%2Fstable-queue.git

4.20-stable patches

added patches:
	netfilter-nf_nat_snmp_basic-add-missing-length-checks-in-asn.1-cbs.patch
---

diff --git a/queue-4.20/netfilter-nf_nat_snmp_basic-add-missing-length-checks-in-asn.1-cbs.patch b/queue-4.20/netfilter-nf_nat_snmp_basic-add-missing-length-checks-in-asn.1-cbs.patch
new file mode 100644
index 00000000000..ee781ee4ea4
--- /dev/null
+++ b/queue-4.20/netfilter-nf_nat_snmp_basic-add-missing-length-checks-in-asn.1-cbs.patch
@@ -0,0 +1,50 @@
+From c4c07b4d6fa1f11880eab8e076d3d060ef3f55fc Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Wed, 6 Feb 2019 22:56:15 +0100
+Subject: netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs
+
+From: Jann Horn <jannh@google.com>
+
+commit c4c07b4d6fa1f11880eab8e076d3d060ef3f55fc upstream.
+
+The generic ASN.1 decoder infrastructure doesn't guarantee that callbacks
+will get as much data as they expect; callbacks have to check the `datalen`
+parameter before looking at `data`. Make sure that snmp_version() and
+snmp_helper() don't read/write beyond the end of the packet data.
+
+(Also move the assignment to `pdata` down below the check to make it clear
+that it isn't necessarily a pointer we can use before the `datalen` check.)
+
+Fixes: cc2d58634e0f ("netfilter: nf_nat_snmp_basic: use asn1 decoder library")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/netfilter/nf_nat_snmp_basic_main.c |    7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
++++ b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
+@@ -105,6 +105,8 @@ static void fast_csum(struct snmp_ctx *c
+ int snmp_version(void *context, size_t hdrlen, unsigned char tag,
+ 		 const void *data, size_t datalen)
+ {
++	if (datalen != 1)
++		return -EINVAL;
+ 	if (*(unsigned char *)data > 1)
+ 		return -ENOTSUPP;
+ 	return 1;
+@@ -114,8 +116,11 @@ int snmp_helper(void *context, size_t hd
+ 		const void *data, size_t datalen)
+ {
+ 	struct snmp_ctx *ctx = (struct snmp_ctx *)context;
+-	__be32 *pdata = (__be32 *)data;
++	__be32 *pdata;
+ 
++	if (datalen != 4)
++		return -EINVAL;
++	pdata = (__be32 *)data;
+ 	if (*pdata == ctx->from) {
+ 		pr_debug("%s: %pI4 to %pI4\n", __func__,
+ 			 (void *)&ctx->from, (void *)&ctx->to);
diff --git a/queue-4.20/series b/queue-4.20/series
index 270e256831d..6fbeb2e1f7a 100644
--- a/queue-4.20/series
+++ b/queue-4.20/series
@@ -26,3 +26,4 @@ scsi-target-core-use-kmem_cache_free-instead-of-kfre.patch
 x86_64-increase-stack-size-for-kasan_extra.patch
 mmc-meson-gx-fix-interrupt-name.patch
 hwmon-lm80-fix-missing-unlock-on-error-in-set_fan_di.patch
+netfilter-nf_nat_snmp_basic-add-missing-length-checks-in-asn.1-cbs.patch