Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit b116697f authored by Tejaswi Tanikella's avatar Tejaswi Tanikella Committed by Gerrit - the friendly Code Review server
Browse files

nf: xt_socket: Fix out-of-bounds in xt_socket_lookup_slow_v{4,6}



skb_header_pointer will copy data into the buffer if data is spread
across pages, else share pointer within skb->data. In
xt_socket_lookup_slow_v4, data is copied into udphdr, and later
th->doff is accessed, causing a out-of-bounds. This
access will only work if the data is not split across pages.

Copy data into tcphdr buffer for TCP packets instead.

Change-Id: Ifd6e15ece27fcf5bd02ae17571ab43f6df3ceb21
Fixes: a583636a ("inet: refactor inet[6]_lookup functions to take skb")
Signed-off-by: default avatarTejaswi Tanikella <tejaswit@codeaurora.org>
parent a56e768c
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment