diff options
| author | Tejaswi Tanikella <tejaswit@codeaurora.org> | 2018-01-05 12:40:48 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-03-28 07:43:00 -0700 |
| commit | b116697fb51e36789339faf2ea19a9cb80e0f82b (patch) | |
| tree | 08f55ed0a2f984a1bdb47d78f133253c127c2e3d /net/tipc/socket.c | |
| parent | a56e768ca3bf5a8484dc28d173984f3960307bdf (diff) | |
nf: xt_socket: Fix out-of-bounds in xt_socket_lookup_slow_v{4,6}
skb_header_pointer will copy data into the buffer if data is spread
across pages, else share pointer within skb->data. In
xt_socket_lookup_slow_v4, data is copied into udphdr, and later
th->doff is accessed, causing a out-of-bounds. This
access will only work if the data is not split across pages.
Copy data into tcphdr buffer for TCP packets instead.
Change-Id: Ifd6e15ece27fcf5bd02ae17571ab43f6df3ceb21
Fixes: a583636a ("inet: refactor inet[6]_lookup functions to take skb")
Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
Diffstat (limited to 'net/tipc/socket.c')
0 files changed, 0 insertions, 0 deletions