mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-06 08:46:46 +00:00
ipv6: check return value of ipv6_skip_exthdr
[ Upstream commit 5f9c55c806
]
The offset value is used in pointer math on skb->data.
Since ipv6_skip_exthdr may return -1 the pointer to uh and th
may not point to the actual udp and tcp headers and potentially
overwrite other stuff. This is why I think this should be checked.
EDIT: added {}'s, thanks Kees
Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
fc7ffa7f10
commit
634ef8cf4e
1 changed files with 6 additions and 0 deletions
|
@ -808,6 +808,12 @@ int esp6_input_done2(struct sk_buff *skb, int err)
|
|||
struct tcphdr *th;
|
||||
|
||||
offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
|
||||
|
||||
if (offset < 0) {
|
||||
err = -EINVAL;
|
||||
goto out;
|
||||
}
|
||||
|
||||
uh = (void *)(skb->data + offset);
|
||||
th = (void *)(skb->data + offset);
|
||||
hdr_len += offset;
|
||||
|
|
Loading…
Reference in a new issue