Re: [SECURITY] Overrun in net/ipv6/exthdrs.c

[kuznet@xxxxxxxxxxxxx]

Hello!

> We've found buffer overrun bug while parsing ipv6 extension headers
> in linux2{2,4}/net/ipv6/exthdrs.c.

The patch, which you have sent some time ago (it contained
also some fixes to mld etc.) has been merged. (Sorry, it is still not
in main 2.4.2 tree).

Does this new patch have some differences of older one?

Alexey


PS:

> +                     if (len < 2)
> +                             goto bad;
> +                     optlen = ptr[1]+2;
> +                     if (len < optlen)
> +                             goto bad;

The first check is useless, it is identity.
We use the trick that each skb has space of 16 bytes behind
its tail and allow references beyond end of packet to simplify
parsing of objects containing length encoded in the first octets.

                        objlen = ptr[N];
                        if (objlen < MIN_OBJLEN || objlen > TRUE_LEN)
                                parse_error;

is legal.

Alexey