* [PATCH net] ipv6: sr: fix out-of-bounds access in SRH validation
@ 2017-04-18 15:59 David Lebrun
2017-04-20 19:41 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: David Lebrun @ 2017-04-18 15:59 UTC (permalink / raw)
To: netdev; +Cc: David Lebrun, Andrey Konovalov
This patch fixes an out-of-bounds access in seg6_validate_srh() when the
trailing data is less than sizeof(struct sr6_tlv).
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David Lebrun <david.lebrun@uclouvain.be>
---
net/ipv6/seg6.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index a855eb3..5f44ffe 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -53,6 +53,9 @@ bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len)
struct sr6_tlv *tlv;
unsigned int tlv_len;
+ if (trailing < sizeof(*tlv))
+ return false;
+
tlv = (struct sr6_tlv *)((unsigned char *)srh + tlv_offset);
tlv_len = sizeof(*tlv) + tlv->len;
--
2.10.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-04-20 19:41 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-04-18 15:59 [PATCH net] ipv6: sr: fix out-of-bounds access in SRH validation David Lebrun
2017-04-20 19:41 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox