leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

filter: use size of fetched data in __load_pointer()

Browse Source 
__load_pointer() checks data we fetch from skb is included in head
portion, but assumes we fetch one byte, instead of up to four.

This wont crash because we have extra bytes (struct skb_shared_info)
after head, but this can read uninitialized bytes.

Fix this using size of the data (1, 2, 4 bytes) in the test.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet 2010-12-07 22:26:15 +00:00 committed by David S. Miller
parent 60d509c823
commit 4bc65dd8d8
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/core/filter.c
View File

@ -88,7 +88,7 @@ enum {
};
/* No hurry in this branch */
static void *__load_pointer(const struct sk_buff *skb, int k)
static void *__load_pointer(const struct sk_buff *skb, int k, unsigned int size)
{
u8 *ptr = NULL;
@ -97,7 +97,7 @@ static void *__load_pointer(const struct sk_buff *skb, int k)
else if (k >= SKF_LL_OFF)
ptr = skb_mac_header(skb) + k - SKF_LL_OFF;
if (ptr >= skb->head && ptr < skb_tail_pointer(skb))
if (ptr >= skb->head && ptr + size <= skb_tail_pointer(skb))
return ptr;
return NULL;
}
@ -110,7 +110,7 @@ static inline void *load_pointer(const struct sk_buff *skb, int k,
else {
if (k >= SKF_AD_OFF)
return NULL;
return __load_pointer(skb, k);
return __load_pointer(skb, k, size);
}
}