Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-10 22:21:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipv6: avoid overflow of offset in ip6_find_1stfragopt

Browse Source 
In some cases, offset can overflow and can cause an infinite loop in
ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.

This problem has been here since before the beginning of git history.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Sabrina Dubroca 2017-07-19 22:28:55 +02:00 committed by David S. Miller
parent 1e6c22aef2
commit 6399f1fae4
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
net/ipv6/output_core.c
View File

@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
{ {
u16 offset = sizeof(struct ipv6hdr); unsigned int offset = sizeof(struct ipv6hdr);
unsigned int packet_len = skb_tail_pointer(skb) - unsigned int packet_len = skb_tail_pointer(skb) -
skb_network_header(skb); skb_network_header(skb);
int found_rhdr = 0; int found_rhdr = 0;
@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
while (offset <= packet_len) { while (offset <= packet_len) {
struct ipv6_opt_hdr *exthdr; struct ipv6_opt_hdr *exthdr;
unsigned int len;
switch (**nexthdr) { switch (**nexthdr) {
@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) + exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
offset); offset);
offset += ipv6_optlen(exthdr); len = ipv6_optlen(exthdr);
if (len + offset >= IPV6_MAXPLEN)
return -EINVAL;
offset += len;
*nexthdr = &exthdr->nexthdr; *nexthdr = &exthdr->nexthdr;
} }