Messages in this thread | | | Date | Sat, 07 Aug 2010 20:24:16 -0700 (PDT) | Subject | Re: [PATCH] tcp: no md5sig option size check bug | From | David Miller <> |
| |
From: Dmitry Popov <dp@highloadlab.com> Date: Sat, 7 Aug 2010 23:17:52 +0400
> From: Dmitry Popov <dp@highloadlab.com> > > tcp_parse_md5sig_option doesn't check md5sig option (TCPOPT_MD5SIG) > length, but tcp_v[46]_inbound_md5_hash assume that it's at least 16 > bytes long. > > Signed-off-by: Dmitry Popov <dp@highloadlab.com>
I'll apply this, but the memcmp() we do against this pointer is always safe because there's at least skb_shared_info()'s worth of valid memory past skb->data guarenteed at all times which is much larger than 16 bytes.
So at worst we'd access garbage, but never past a valid piece of allocated memory.
Thanks.
| |