Message ID | 20210310160135.1148272-5-philmd@redhat.com |
---|---|
State | New |
Headers | show |
Series | net/eth: Fix stack-buffer-overflow in _eth_get_rss_ex_dst_addr() | expand |
On Wed, Mar 10, 2021 at 05:01:32PM +0100, Philippe Mathieu-Daudé wrote: >Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> >--- > net/eth.c | 14 ++++++-------- > 1 file changed, 6 insertions(+), 8 deletions(-) Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> > >diff --git a/net/eth.c b/net/eth.c >index 7c47a267a7a..e870d02b0df 100644 >--- a/net/eth.c >+++ b/net/eth.c >@@ -406,16 +406,14 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags, > struct in6_address *dst_addr) > { > struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr; >+ size_t input_size = iov_size(pkt, pkt_frags); >+ size_t bytes_read; >+ >+ if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) { >+ return false; >+ } > > if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) { >- >- size_t input_size = iov_size(pkt, pkt_frags); >- size_t bytes_read; >- >- if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) { >- return false; >- } >- > bytes_read = iov_to_buf(pkt, pkt_frags, > ext_hdr_offset + sizeof(*ext_hdr), > dst_addr, sizeof(*dst_addr)); >-- >2.26.2 >
diff --git a/net/eth.c b/net/eth.c index 7c47a267a7a..e870d02b0df 100644 --- a/net/eth.c +++ b/net/eth.c @@ -406,16 +406,14 @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags, struct in6_address *dst_addr) { struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr; + size_t input_size = iov_size(pkt, pkt_frags); + size_t bytes_read; + + if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) { + return false; + } if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) { - - size_t input_size = iov_size(pkt, pkt_frags); - size_t bytes_read; - - if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) { - return false; - } - bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(*ext_hdr), dst_addr, sizeof(*dst_addr));
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> --- net/eth.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)