summaryrefslogtreecommitdiff
path: root/net/ipv6
diff options
context:
space:
mode:
authorJordy Zomer <jordy@pwning.systems>2021-11-17 22:06:48 +0300
committerDavid S. Miller <davem@davemloft.net>2021-11-18 14:42:06 +0300
commit5f9c55c8066bcd93ac25234a02585701fe2e31df (patch)
tree9cfd5b6e77e0bde6d275d7414fb0d321929b9cec /net/ipv6
parent5d2ca2e12dfb2aff3388ca57b06f570fa6206ced (diff)
downloadlinux-5f9c55c8066bcd93ac25234a02585701fe2e31df.tar.xz
ipv6: check return value of ipv6_skip_exthdr
The offset value is used in pointer math on skb->data. Since ipv6_skip_exthdr may return -1 the pointer to uh and th may not point to the actual udp and tcp headers and potentially overwrite other stuff. This is why I think this should be checked. EDIT: added {}'s, thanks Kees Signed-off-by: Jordy Zomer <jordy@pwning.systems> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
-rw-r--r--net/ipv6/esp6.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index ed2f061b8768..f0bac6f7ab6b 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -808,6 +808,12 @@ int esp6_input_done2(struct sk_buff *skb, int err)
struct tcphdr *th;
offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
+
+ if (offset < 0) {
+ err = -EINVAL;
+ goto out;
+ }
+
uh = (void *)(skb->data + offset);
th = (void *)(skb->data + offset);
hdr_len += offset;