Messages in this thread | | | Date | Tue, 23 Mar 2010 11:05:40 +0800 | Subject | Re: [PATCH] Netfilter: Fix integer overflow in net/ipv6/netfilter/ip6_tables.c | From | Xiaotian Feng <> |
| |
On Tue, Mar 23, 2010 at 10:37 AM, wzt wzt <wzt.wzt@gmail.com> wrote: >> Patrick's point is that you're using "if (get.size >= INT_MAX / >> sizeof(struct ipt_get_entries))" >> So, did you find any chance that get.size * sizeof(struct >> ipt_get_entries) >= INT_MAX ? >> > would you carefully read my explain??? > get.size is copy from the user space, it can be set as 0x7fffffff, > addition with sizeof(struct ipt_get_entries) can be overflow. >
get.size is unsigned int, UINT_MAX is 0x FFFFFFFF, not 0x7FFFFFFF And you're metioning "addition", then why you're checking as "multiplication"?
>> And, for the addition overflow, can it be caught by >> >> "if (*len != sizeof(struct ipt_get_entries) + get.size)" ??? >> > sizeof(struct ipt_get_entries) + get.size can be overflow as *len, > get.size is control by user space with copy_from_user().
> > On Tue, Mar 23, 2010 at 10:29 AM, Xiaotian Feng <xtfeng@gmail.com> wrote: >> On Tue, Mar 23, 2010 at 9:34 AM, wzt wzt <wzt.wzt@gmail.com> wrote: >>>> I can see that the size might cause an overflow in the addition with >>>> sizeof(struct ipt_get_entries) >>> That's the integer overflow i pointed. >>> get.size is copy from the user space, it can be set as 0x7fffffff, >>> addition with sizeof(struct ipt_get_entries) can be overflow. >> >> Patrick's point is that you're using "if (get.size >= INT_MAX / >> sizeof(struct ipt_get_entries))" >> So, did you find any chance that get.size * sizeof(struct >> ipt_get_entries) >= INT_MAX ? >> >> And, for the addition overflow, can it be caught by >> >> "if (*len != sizeof(struct ipt_get_entries) + get.size)" ??? >> >>> >>> if (*len != sizeof(struct ipt_get_entries) + get.size) { >>> duprintf("get_entries: %u != %zu\n", >>> *len, sizeof(get) + get.size); >>> return -EINVAL; >>> } >>> >>> so, check get.size max value before addition with sizeof(struct >>> ipt_get_entries) to prevent the integer overflow. >>> -- >>> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in >>> the body of a message to majordomo@vger.kernel.org >>> More majordomo info at http://vger.kernel.org/majordomo-info.html >>> Please read the FAQ at http://www.tux.org/lkml/ >>> >> > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |