diff mbox series

[SRU,N] tipc: Return non-zero value from tipc_udp_addr2str() on error

Message ID 20240918050614.1855193-2-koichiro.den@canonical.com
State New
Headers show
Series [SRU,N] tipc: Return non-zero value from tipc_udp_addr2str() on error | expand

Commit Message

Koichiro Den Sept. 18, 2024, 5:06 a.m. UTC 
From: Shigeru Yoshida <syoshida@redhat.com>

tipc_udp_addr2str() should return non-zero value if the UDP media
address is invalid. Otherwise, a buffer overflow access can occur in
tipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP
media address.

Fixes: d0f91938bede ("tipc: add ip/udp media type")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Tung Nguyen <tung.q.nguyen@endava.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit fa96c6baef1b5385e2f0c0677b32b3839e716076)
CVE-2024-42284
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
---
 net/tipc/udp_media.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index b849a3d133a0..439f75539977 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -135,8 +135,11 @@  static int tipc_udp_addr2str(struct tipc_media_addr *a, char *buf, int size)
 		snprintf(buf, size, "%pI4:%u", &ua->ipv4, ntohs(ua->port));
 	else if (ntohs(ua->proto) == ETH_P_IPV6)
 		snprintf(buf, size, "%pI6:%u", &ua->ipv6, ntohs(ua->port));
-	else
+	else {
 		pr_err("Invalid UDP media address\n");
+		return 1;
+	}
+
 	return 0;
 }