diff options
author | Marek Lindner <lindner_marek@yahoo.de> | 2013-03-03 21:39:49 -0500 |
---|---|---|
committer | Antonio Quartulli <ordex@autistici.org> | 2013-03-11 17:59:47 -0400 |
commit | b47506d91259c29b9c75c404737eb6525556f9b4 (patch) | |
tree | c23e5fb025c23fc7a19a0c5fdf4fdcd411596a9f | |
parent | 7c6baa304b841673d3a55ea4fcf9a5cbf7a1674b (diff) |
batman-adv: verify tt len does not exceed packet len
batadv_iv_ogm_process() accesses the packet using the tt_num_changes
attribute regardless of the real packet len (assuming the length check
was done before). Therefore a length check is needed to avoid reading
random memory.
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
-rw-r--r-- | net/batman-adv/bat_iv_ogm.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c index a0b253ecadaf..a5bb0a769eb9 100644 --- a/net/batman-adv/bat_iv_ogm.c +++ b/net/batman-adv/bat_iv_ogm.c | |||
@@ -1288,7 +1288,8 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb, | |||
1288 | batadv_ogm_packet = (struct batadv_ogm_packet *)packet_buff; | 1288 | batadv_ogm_packet = (struct batadv_ogm_packet *)packet_buff; |
1289 | 1289 | ||
1290 | /* unpack the aggregated packets and process them one by one */ | 1290 | /* unpack the aggregated packets and process them one by one */ |
1291 | do { | 1291 | while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len, |
1292 | batadv_ogm_packet->tt_num_changes)) { | ||
1292 | tt_buff = packet_buff + buff_pos + BATADV_OGM_HLEN; | 1293 | tt_buff = packet_buff + buff_pos + BATADV_OGM_HLEN; |
1293 | 1294 | ||
1294 | batadv_iv_ogm_process(ethhdr, batadv_ogm_packet, tt_buff, | 1295 | batadv_iv_ogm_process(ethhdr, batadv_ogm_packet, tt_buff, |
@@ -1299,8 +1300,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb, | |||
1299 | 1300 | ||
1300 | packet_pos = packet_buff + buff_pos; | 1301 | packet_pos = packet_buff + buff_pos; |
1301 | batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos; | 1302 | batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos; |
1302 | } while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len, | 1303 | } |
1303 | batadv_ogm_packet->tt_num_changes)); | ||
1304 | 1304 | ||
1305 | kfree_skb(skb); | 1305 | kfree_skb(skb); |
1306 | return NET_RX_SUCCESS; | 1306 | return NET_RX_SUCCESS; |