From: Ang Way Chuang <wcang79@gmail.com>
To: linux-kernel@vger.kernel.org
Subject: [PATCH] dvb-core: Fix DoS bug in ULE decapsulation code that can be triggered by an invalid Payload Pointer
Date: Sat, 27 Feb 2010 09:44:22 +0800 [thread overview]
Message-ID: <4B8878F6.8000809@gmail.com> (raw)
Hi guys,
Sorry, I have to resend this email because I think my email didn't
through linux-media, stable or security mailing list.
ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
has a bug that causes endless loop when Payload Pointer of MPEG2-TS
frame is 182 or 183. Anyone who sends malicious MPEG2-TS frame will
cause the receiver of ULE SNDU to go into endless loop.
This patch was generated and tested against linux-2.6.32.9 and should
apply cleanly to linux-2.6.33 as well because there was only one typo
fix to dvb_net.c since v2.6.32.
This bug was brought to you by modern day Santa Claus who decided to
shower the satellite dish at Keio University with heavy snow causing huge
burst of errors. We, receiver end, received Santa Claus's gift in the form
of kernel bug.
Care has been taken not to introduce more bug by fixing this bug, but
please scrutinize the code because I always produces buggy code.
Signed-off-by: Ang Way Chuang <wcang79@gmail.com>
---
--- linux-2.6.32.9/drivers/media/dvb/dvb-core/dvb_net.c 2010-02-23 23:38:51.000000000 +0800
+++ linux-2.6.32.9.new/drivers/media/dvb/dvb-core/dvb_net.c 2010-02-25 04:09:18.000000000 +0800
@@ -504,6 +504,7 @@ static void dvb_net_ule( struct net_devi
"bytes left in TS. Resyncing.\n", ts_remain);
priv->ule_sndu_len = 0;
priv->need_pusi = 1;
+ ts += TS_SZ;
continue;
}
reply other threads:[~2010-02-27 1:44 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4B8878F6.8000809@gmail.com \
--to=wcang79@gmail.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox