Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-26 06:02:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

batman-adv: check for tt_reponse packet real length

Browse Source 
Before accessing the TT_RESPONSE packet payload, the node has to ensure that the
packet is long enough as it would expect to be.

Reported-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Signed-off-by: Antonio Quartulli <ordex@autistici.org>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
This commit is contained in:
Antonio Quartulli 2011-10-16 20:32:03 +02:00 committed by Sven Eckelmann
parent dc58fe32e6
commit 8b7342d673
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
net/batman-adv/routing.c
View File

@ -578,6 +578,7 @@ int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if)
{
struct bat_priv *bat_priv = netdev_priv(recv_if->soft_iface);
struct tt_query_packet *tt_query;
uint16_t tt_len;
struct ethhdr *ethhdr;
/* drop packet if it has not necessary minimum size */
@ -622,6 +623,14 @@ int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if)
if (skb_linearize(skb) < 0)
goto out;
tt_len = tt_query->tt_data * sizeof(struct tt_change);
/* Ensure we have all the claimed data */
if (unlikely(skb_headlen(skb) <
sizeof(struct tt_query_packet) +
tt_len))
goto out;
handle_tt_response(bat_priv, tt_query);
} else {
bat_dbg(DBG_TT, bat_priv,