]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/commit
dccp: fix out of bound access in dccp_v4_err()
authorEric Dumazet <edumazet@google.com>
Thu, 3 Nov 2016 02:00:40 +0000 (19:00 -0700)
committerLuis Henriques <luis.henriques@canonical.com>
Tue, 6 Dec 2016 16:53:10 +0000 (16:53 +0000)
commit75af67d47fe04f97ab40dd31c1ce0f622349b653
tree4fde8942de667aa319fac14f636a4b4ec17b7121
parentb8577e45f3f9cea30c9ae4cbe7f70e6ae3fe8c92
dccp: fix out of bound access in dccp_v4_err()

BugLink: http://bugs.launchpad.net/bugs/1643637
[ Upstream commit 6706a97fec963d6cb3f7fc2978ec1427b4651214 ]

dccp_v4_err() does not use pskb_may_pull() and might access garbage.

We only need 4 bytes at the beginning of the DCCP header, like TCP,
so the 8 bytes pulled in icmp_socket_deliver() are more than enough.

This patch might allow to process more ICMP messages, as some routers
are still limiting the size of reflected bytes to 28 (RFC 792), instead
of extended lengths (RFC 1812 4.3.2.3)

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
net/dccp/ipv4.c