netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 1/2] xfrm4: fix the ports decode of sctp protocol
@ 2009-07-03  2:57 Wei Yongjun
  2009-07-03  2:59 ` [PATCH 2/2] xfrm6: fix the proto and " Wei Yongjun
  2009-07-03  3:48 ` [PATCH 1/2] xfrm4: fix the " Herbert Xu
  0 siblings, 2 replies; 6+ messages in thread
From: Wei Yongjun @ 2009-07-03  2:57 UTC (permalink / raw)
  To: Herbert Xu, David Miller; +Cc: Netdev

The SCTP pushed the skb data above the sctp chunk header, so the check
of pskb_may_pull(skb, xprth + 4 - skb->data) in _decode_session4() will
never return 0 because xprth + 4 - skb->data < 0, the ports decode of
sctp will always fail.

Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
---
 net/ipv4/xfrm4_policy.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 60d918c..0071ee6 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -136,7 +136,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
 		case IPPROTO_TCP:
 		case IPPROTO_SCTP:
 		case IPPROTO_DCCP:
-			if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
+			if (xprth + 4 < skb->data ||
+			    pskb_may_pull(skb, xprth + 4 - skb->data)) {
 				__be16 *ports = (__be16 *)xprth;
 
 				fl->fl_ip_sport = ports[!!reverse];
-- 
1.6.2.2





^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2009-07-04  2:11 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-07-03  2:57 [PATCH 1/2] xfrm4: fix the ports decode of sctp protocol Wei Yongjun
2009-07-03  2:59 ` [PATCH 2/2] xfrm6: fix the proto and " Wei Yongjun
2009-07-03  3:49   ` Herbert Xu
2009-07-04  2:11     ` David Miller
2009-07-03  3:48 ` [PATCH 1/2] xfrm4: fix the " Herbert Xu
2009-07-04  2:10   ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).