diff options
| author | Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> | 2023-05-23 08:29:44 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-05-30 14:03:21 +0100 |
| commit | 91dd8aab9c9f193210681b86b6b92840ffe74f0c (patch) | |
| tree | c471f73bd09282628de27259a46ab30ff5de58b9 | |
| parent | 9bc1dbfd9158c53b11c458559381998c04e8c240 (diff) | |
| download | linux-91dd8aab9c9f193210681b86b6b92840ffe74f0c.tar.gz linux-91dd8aab9c9f193210681b86b6b92840ffe74f0c.tar.bz2 linux-91dd8aab9c9f193210681b86b6b92840ffe74f0c.zip | |
ipv6: Fix out-of-bounds access in ipv6_find_tlv()
commit 878ecb0897f4737a4c9401f3523fd49589025671 upstream.
optlen is fetched without checking whether there is more than one byte to parse.
It can lead to out-of-bounds access.
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Fixes: c61a40432509 ("[IPV6]: Find option offset by type.")
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/ipv6/exthdrs_core.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c index da46c4284676..49e31e4ae7b7 100644 --- a/net/ipv6/exthdrs_core.c +++ b/net/ipv6/exthdrs_core.c @@ -143,6 +143,8 @@ int ipv6_find_tlv(const struct sk_buff *skb, int offset, int type) optlen = 1; break; default: + if (len < 2) + goto bad; optlen = nh[offset + 1] + 2; if (optlen > len) goto bad; |