mir/ovs
2
0
Fork 0
mirror of https://github.com/openvswitch/ovs synced 2025-09-05 08:45:23 +00:00
Code Issues Releases Wiki Activity

flow: Fix buffer overread for crafted IPv6 packets.

Browse Source 
The ipv6_sanity_check() function implemented a check for IPv6 payload
length wrong: ip6_plen is the payload length but this function checked
whether it was longer than the total length of IPv6 header plus payload.
This meant that a packet with a crafted ip6_plen could result in a buffer
overread of up to the length of an IPv6 header (40 bytes).

The kernel datapath flow extraction code does not obviously have a similar
problem.

Reported-at: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9287
Signed-off-by: Ben Pfaff <blp@ovn.org>
Acked-by: Darrell Ball <dlu998@gmail.com>
This commit is contained in:
Ben Pfaff
2018-07-09 13:04:03 -07:00
parent f5129153e3
commit 4fe0801606
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/flow.c
View File

@@ -677,7 +677,7 @@ ipv6_sanity_check(const struct ovs_16aligned_ip6_hdr *nh, size_t size)
}
plen = ntohs(nh->ip6_plen);
if (OVS_UNLIKELY(plen > size)) {
if (OVS_UNLIKELY(plen + IPV6_HEADER_LEN > size)) {
return false;
}
/* Jumbo Payload option not supported yet. */