diff options
| author | Stefan Richter <stefanr@s5r6.in-berlin.de> | 2016-10-29 21:28:18 +0200 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-11 10:58:41 +0200 |
| commit | 4e133ccd2c80331521d5ad4ad1cf7104c4007cb5 (patch) | |
| tree | b0449fafebc6aaebc3be6bc5b934f465bf890794 /include/linux/moduleloader.h | |
| parent | 7dab80ada2121cfa5fe2ddc6a9edd403428bbc15 (diff) | |
firewire: net: guard against rx buffer overflows
commit 667121ace9dbafb368618dbabcf07901c962ddac upstream.
The IP-over-1394 driver firewire-net lacked input validation when
handling incoming fragmented datagrams. A maliciously formed fragment
with a respectively large datagram_offset would cause a memcpy past the
datagram buffer.
So, drop any packets carrying a fragment with offset + length larger
than datagram_size.
In addition, ensure that
- GASP header, unfragmented encapsulation header, or fragment
encapsulation header actually exists before we access it,
- the encapsulated datagram or fragment is of nonzero size.
Reported-by: Eyal Itkin <eyal.itkin@gmail.com>
Reviewed-by: Eyal Itkin <eyal.itkin@gmail.com>
Fixes: CVE 2016-8633
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Diffstat (limited to 'include/linux/moduleloader.h')
0 files changed, 0 insertions, 0 deletions