)]}'
{
  "commit": "e0b5252a59383b77d1b8dbeda00b7184dd95f4d3",
  "tree": "a7021b05401222c576497e2c80f0c76906c5d60c",
  "parents": [
    "f1f5c8a3955f8fda3f84ed883ac8daa1847e724c"
  ],
  "author": {
    "name": "Xin Long",
    "email": "lucien.xin@gmail.com",
    "time": "Fri Jul 10 14:12:35 2026 -0400"
  },
  "committer": {
    "name": "Paolo Abeni",
    "email": "pabeni@redhat.com",
    "time": "Fri Jul 17 12:27:53 2026 +0200"
  },
  "message": "sctp: fix auth_hmacs array size in struct sctp_cookie\n\nThe auth_hmacs array in struct sctp_cookie is supposed to store a complete\nSCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr\nfollowed by N HMAC identifiers.\n\nHowever, the array size was calculated using an extra 2 bytes instead of\nsizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers\nare configured, the HMAC-ALGO parameter stored in the endpoint is larger\nthan the auth_hmacs buffer in the cookie.\n\nAs a result, sctp_association_init() copies beyond the end of auth_hmacs\nwhen initializing the association, corrupting the adjacent auth_chunks\nfield. This can lead to an invalid HMAC identifier being accepted and later\ncause an out-of-bounds read in sctp_auth_get_hmac().\n\nFix the array size calculation by including the full SCTP parameter header\nsize.\n\nFixes: 1f485649f529 (\"[SCTP]: Implement SCTP-AUTH internals\")\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nReported-by: Xin Liu \u003cdstsmallbird@foxmail.com\u003e\nReported-by: Zihan Xi \u003cxizh2024@lzu.edu.cn\u003e\nReported-by: Ren Wei \u003cenjou1224z@gmail.com\u003e\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/634a0de0d5de29532915e6d47c92a0cbc206e03f.1783707155.git.lucien.xin@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "affee44bd38e31f71cd8da75e3dd983840b52209",
      "old_mode": 33188,
      "old_path": "include/net/sctp/structs.h",
      "new_id": "cccc662561aac391999148ce8ae0e8df03f08d67",
      "new_mode": 33188,
      "new_path": "include/net/sctp/structs.h"
    }
  ]
}