diff options
| author | Eric Dumazet <[email protected]> | 2017-02-05 07:18:55 +0000 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2017-02-05 22:23:04 +0000 |
| commit | 7892032cfe67f4bde6fc2ee967e45a8fbaf33756 (patch) | |
| tree | cbadc1cb0484fbdcd3d5d68d5189c1d022d0d0d4 /net/ipv6/tcp_ipv6.c | |
| parent | netlabel: out of bound access in cipso_v4_validate() (diff) | |
| download | kernel-7892032cfe67f4bde6fc2ee967e45a8fbaf33756.tar.gz kernel-7892032cfe67f4bde6fc2ee967e45a8fbaf33756.zip | |
ip6_gre: fix ip6gre_err() invalid reads
Andrey Konovalov reported out of bound accesses in ip6gre_err()
If GRE flags contains GRE_KEY, the following expression
*(((__be32 *)p) + (grehlen / 4) - 1)
accesses data ~40 bytes after the expected point, since
grehlen includes the size of IPv6 headers.
Let's use a "struct gre_base_hdr *greh" pointer to make this
code more readable.
p[1] becomes greh->protocol.
grhlen is the GRE header length.
Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <[email protected]>
Reported-by: Andrey Konovalov <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'net/ipv6/tcp_ipv6.c')
0 files changed, 0 insertions, 0 deletions