Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 44072500 authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[IPSEC]: Fix length check in xfrm_parse_spi 



Currently xfrm_parse_spi requires there to be 16 bytes for AH and ESP.
In contrived cases there may not actually be 16 bytes there since the
respective header sizes are less than that (8 and 12 currently).

This patch changes the test to use the actual header length instead of 16.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7aa68cb9

net/xfrm/xfrm_input.c

+4 −1
Original line number Diff line number Diff line
@@ -49,13 +49,16 @@ EXPORT_SYMBOL(secpath_dup); 
int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)

{

	int offset, offset_seq;

	int hlen;



	switch (nexthdr) {

	case IPPROTO_AH:

		hlen = sizeof(struct ip_auth_hdr);

		offset = offsetof(struct ip_auth_hdr, spi);

		offset_seq = offsetof(struct ip_auth_hdr, seq_no);

		break;

	case IPPROTO_ESP:

		hlen = sizeof(struct ip_esp_hdr);

		offset = offsetof(struct ip_esp_hdr, spi);

		offset_seq = offsetof(struct ip_esp_hdr, seq_no);

		break;
@@ -69,7 +72,7 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq) 
		return 1;

	}



	if (!pskb_may_pull(skb, 16))

	if (!pskb_may_pull(skb, hlen))

		return -EINVAL;



	*spi = *(__be32*)(skb_transport_header(skb) + offset);