Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 41d33a5b authored by Sabrina Dubroca's avatar Sabrina Dubroca Committed by Greg Kroah-Hartman
Browse files

ipv6: avoid overflow of offset in ip6_find_1stfragopt 




[ Upstream commit 6399f1fae4ec29fab5ec76070435555e256ca3a6 ]

In some cases, offset can overflow and can cause an infinite loop in
ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.

This problem has been here since before the beginning of git history.

Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e32f7a70

net/ipv6/output_core.c

+6 −2
Original line number Diff line number Diff line
@@ -44,7 +44,7 @@ EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident); 


int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)

{

	u16 offset = sizeof(struct ipv6hdr);

	unsigned int offset = sizeof(struct ipv6hdr);

	unsigned int packet_len = skb_tail_pointer(skb) -

		skb_network_header(skb);

	int found_rhdr = 0;
@@ -52,6 +52,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) 


	while (offset <= packet_len) {

		struct ipv6_opt_hdr *exthdr;

		unsigned int len;



		switch (**nexthdr) {
@@ -77,7 +78,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) 


		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +

						 offset);

		offset += ipv6_optlen(exthdr);

		len = ipv6_optlen(exthdr);

		if (len + offset >= IPV6_MAXPLEN)

			return -EINVAL;

		offset += len;

		*nexthdr = &exthdr->nexthdr;

	}