mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 15:47:36 +00:00
netfilter: ip6t_eui: fix read outside array bounds
Use memcmp() instead of open coded comparison that reads one byte past the intended end. Based on patch from Roel Kluin <roel.kluin@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
This commit is contained in:
parent
ee254fa44d
commit
4889086969
1 changed files with 2 additions and 7 deletions
|
@ -23,7 +23,6 @@ static bool
|
|||
eui64_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
|
||||
{
|
||||
unsigned char eui64[8];
|
||||
int i = 0;
|
||||
|
||||
if (!(skb_mac_header(skb) >= skb->head &&
|
||||
skb_mac_header(skb) + ETH_HLEN <= skb->data) &&
|
||||
|
@ -42,12 +41,8 @@ eui64_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
|
|||
eui64[4] = 0xfe;
|
||||
eui64[0] ^= 0x02;
|
||||
|
||||
i = 0;
|
||||
while (ipv6_hdr(skb)->saddr.s6_addr[8 + i] == eui64[i]
|
||||
&& i < 8)
|
||||
i++;
|
||||
|
||||
if (i == 8)
|
||||
if (!memcmp(ipv6_hdr(skb)->saddr.s6_addr + 8, eui64,
|
||||
sizeof(eui64)))
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue