lkml.org 
[lkml]   [2013]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 007/171 ] batman-adv: verify tt len does not exceed packet len
    3.6.11.2 stable review patch.
    If anyone has any objections, please let me know.

    ------------------

    From: Marek Lindner <lindner_marek@yahoo.de>

    [ Upstream commit b47506d91259c29b9c75c404737eb6525556f9b4 ]

    batadv_iv_ogm_process() accesses the packet using the tt_num_changes
    attribute regardless of the real packet len (assuming the length check
    was done before). Therefore a length check is needed to avoid reading
    random memory.

    Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
    Signed-off-by: Antonio Quartulli <ordex@autistici.org>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    ---
    net/batman-adv/bat_iv_ogm.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
    index 1476f26..aca451e 100644
    --- a/net/batman-adv/bat_iv_ogm.c
    +++ b/net/batman-adv/bat_iv_ogm.c
    @@ -1273,7 +1273,8 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
    batadv_ogm_packet = (struct batadv_ogm_packet *)packet_buff;

    /* unpack the aggregated packets and process them one by one */
    - do {
    + while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,
    + batadv_ogm_packet->tt_num_changes)) {
    tt_buff = packet_buff + buff_pos + BATADV_OGM_HLEN;

    batadv_iv_ogm_process(ethhdr, batadv_ogm_packet, tt_buff,
    @@ -1284,8 +1285,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,

    batadv_ogm_packet = (struct batadv_ogm_packet *)
    (packet_buff + buff_pos);
    - } while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,
    - batadv_ogm_packet->tt_num_changes));
    + }

    kfree_skb(skb);
    return NET_RX_SUCCESS;
    --
    1.7.10.4



    \
     
     \ /
      Last update: 2013-04-12 03:41    [W:4.039 / U:0.256 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site