| Message ID | 1301207244-10428-3-git-send-email-linus.luessing@web.de |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Linus Lüssing <linus.luessing@web.de> Date: Sun, 27 Mar 2011 08:27:24 +0200 > "len = ntohs(ip6h->payload_len)" does not include the length of the ipv6 > header itself, which the rest of this function assumes, though. > > This leads to a length check less restrictive as it should be in the > following line for one thing. For another, it very likely leads to an > integer underrun when substracting the offset and therefore to a very > high new value of 'len' due to its unsignedness. This will ultimately > lead to the pskb_trim_rcsum() practically never being called, even in > the cases where it should. > > Signed-off-by: Linus Lüssing <linus.luessing@web.de> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index 47fae4f..3793264 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -1475,7 +1475,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br, ip6h->payload_len == 0) return 0; - len = ntohs(ip6h->payload_len); + len = ntohs(ip6h->payload_len) + sizeof(*ip6h); if (skb->len < len) return -EINVAL;
"len = ntohs(ip6h->payload_len)" does not include the length of the ipv6 header itself, which the rest of this function assumes, though. This leads to a length check less restrictive as it should be in the following line for one thing. For another, it very likely leads to an integer underrun when substracting the offset and therefore to a very high new value of 'len' due to its unsignedness. This will ultimately lead to the pskb_trim_rcsum() practically never being called, even in the cases where it should. Signed-off-by: Linus Lüssing <linus.luessing@web.de> --- net/bridge/br_multicast.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)