From mboxrd@z Thu Jan 1 00:00:00 1970 From: Tomasz Duszynski Subject: [PATCH] examples/ipsec-secgw: fix ip version check Date: Fri, 13 Oct 2017 14:50:09 +0200 Message-ID: <1507899009-20393-1-git-send-email-tdu@semihalf.com> Cc: Tomasz Duszynski , stable@dpdk.org To: dev@dpdk.org Return-path: Received: from mail-lf0-f44.google.com (mail-lf0-f44.google.com [209.85.215.44]) by dpdk.org (Postfix) with ESMTP id 59F371B6BE for ; Fri, 13 Oct 2017 14:50:19 +0200 (CEST) Received: by mail-lf0-f44.google.com with SMTP id b190so9501790lfg.9 for ; Fri, 13 Oct 2017 05:50:19 -0700 (PDT) List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" Since new_ip and ip4 are overlapping buffers copying ip4 over new_ip using memmove() might overwrite memory at ip4. This could happen if following condition holds: ip_hdr_len > sizeof(struct esp_hdr) + sa->iv_len Thus using ip4 to check ip version is wrong as it might not contain proper value. Fixes: f159e70b0922 ("examples/ipsec-secgw: support transport mode") Cc: stable@dpdk.org Signed-off-by: Tomasz Duszynski --- examples/ipsec-secgw/esp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/ipsec-secgw/esp.c b/examples/ipsec-secgw/esp.c index 2897840..063e63f 100644 --- a/examples/ipsec-secgw/esp.c +++ b/examples/ipsec-secgw/esp.c @@ -307,8 +307,8 @@ esp_outbound(struct rte_mbuf *m, struct ipsec_sa *sa, sizeof(struct esp_hdr) + sa->iv_len); memmove(new_ip, ip4, ip_hdr_len); esp = (struct esp_hdr *)(new_ip + ip_hdr_len); + ip4 = (struct ip *)new_ip; if (likely(ip4->ip_v == IPVERSION)) { - ip4 = (struct ip *)new_ip; ip4->ip_p = IPPROTO_ESP; ip4->ip_len = htons(rte_pktmbuf_data_len(m)); } else { -- 2.7.4