Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6399f1fa authored by Sabrina Dubroca's avatar Sabrina Dubroca Committed by David S. Miller
Browse files

ipv6: avoid overflow of offset in ip6_find_1stfragopt 



In some cases, offset can overflow and can cause an infinite loop in
ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.

This problem has been here since before the beginning of git history.

Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1e6c22ae

net/ipv6/output_core.c

+6 −2
Original line number Diff line number Diff line
@@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident); 


int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)

{

	u16 offset = sizeof(struct ipv6hdr);

	unsigned int offset = sizeof(struct ipv6hdr);

	unsigned int packet_len = skb_tail_pointer(skb) -

		skb_network_header(skb);

	int found_rhdr = 0;
@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) 


	while (offset <= packet_len) {

		struct ipv6_opt_hdr *exthdr;

		unsigned int len;



		switch (**nexthdr) {
@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) 


		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +

						 offset);

		offset += ipv6_optlen(exthdr);

		len = ipv6_optlen(exthdr);

		if (len + offset >= IPV6_MAXPLEN)

			return -EINVAL;

		offset += len;

		*nexthdr = &exthdr->nexthdr;

	}