Fix SCTP chunk validation

chunk_payload_data.go

@@ -132,7 +132,7 @@ func (p *chunkPayloadData) unmarshal(raw []byte) error {
 	p.beginningFragment = p.flags&payloadDataBeginingFragmentBitmask != 0
 	p.endingFragment = p.flags&payloadDataEndingFragmentBitmask != 0
 
-	if len(raw) < payloadDataHeaderSize {
+	if len(p.raw) < payloadDataHeaderSize {
 		return ErrChunkPayloadSmall
 	}
 	p.tsn = binary.BigEndian.Uint32(p.raw[0:])

error_cause_header.go

@@ -5,6 +5,7 @@
 
 import (
 	"encoding/binary"
+	"errors"
 )
 
 // errorCauseHeader represents the shared header that is shared by all error causes
@@ -18,6 +19,9 @@
 	errorCauseHeaderLength = 4
 )
 
+// ErrInvalidSCTPChunk is returned when an SCTP chunk is invalid
+var ErrInvalidSCTPChunk = errors.New("invalid SCTP chunk")
+
 func (e *errorCauseHeader) marshal() ([]byte, error) {
 	e.len = uint16(len(e.raw)) + uint16(errorCauseHeaderLength)
 	raw := make([]byte, e.len)
@@ -31,6 +35,9 @@
 func (e *errorCauseHeader) unmarshal(raw []byte) error {
 	e.code = errorCauseCode(binary.BigEndian.Uint16(raw[0:]))
 	e.len = binary.BigEndian.Uint16(raw[2:])
+	if e.len < errorCauseHeaderLength || int(e.len) > len(raw) {
+		return ErrInvalidSCTPChunk
+	}
 	valueLength := e.len - errorCauseHeaderLength
 	e.raw = raw[errorCauseHeaderLength : errorCauseHeaderLength+valueLength]
 	return nil

param_requested_hmac_algorithm.go

@@ -13,14 +13,17 @@
 
 const (
 	hmacResv1  hmacAlgorithm = 0
-	hmacSHA128               = 1
+	hmacSHA128 hmacAlgorithm = 1
 	hmacResv2  hmacAlgorithm = 2
 	hmacSHA256 hmacAlgorithm = 3
 )
 
 // ErrInvalidAlgorithmType is returned if unknown auth algorithm is specified.
 var ErrInvalidAlgorithmType = errors.New("invalid algorithm type")
 
+// ErrInvalidChunkLength is returned if the chunk length is invalid.
+var ErrInvalidChunkLength = errors.New("invalid chunk length")
+
 func (c hmacAlgorithm) String() string {
 	switch c {
 	case hmacResv1:
@@ -58,6 +61,9 @@
 	if err != nil {
 		return nil, err
 	}
+	if len(r.raw)%2 == 1 {
+		return nil, ErrInvalidChunkLength
+	}
 
 	i := 0
 	for i < len(r.raw) {