Re: [PATCH]: ipv6_skip_exthdr() may refer invalid memory area

[Yasuyuki Kozakai <yasuyuki.kozakai@xxxxxxxxxxxxx>]

Hi,

This patch is for linux 2.4.26-pre1 .

-----------------------------------------------------------------
Yasuyuki KOZAKAI @ USAGI Project <yasuyuki.kozakai@xxxxxxxxxxxxx>


From: "David S. Miller" <davem@xxxxxxxxxx>
Date: Fri, 20 Feb 2004 09:30:27 -0800

> On Fri, 20 Feb 2004 14:33:59 +0900 (JST)
> Yasuyuki Kozakai <yasuyuki.kozakai@xxxxxxxxxxxxx> wrote:
> 
> > ipv6_skip_exthdr() refer invalid memory area in the case
> > that packet includes Fragment Header.
> > 
> > please apply this patch.
> 
> Applied, thank you Yasuyuki-san.

diff -Nur linux-2.4.26-pre1/net/ipv6/exthdrs.c 
linux-2.4.26-pre1-fixed/net/ipv6/exthdrs.c
--- linux-2.4.26-pre1/net/ipv6/exthdrs.c        2003-08-25 20:44:44.000000000 
+0900
+++ linux-2.4.26-pre1-fixed/net/ipv6/exthdrs.c  2004-02-26 10:44:21.000000000 
+0900
@@ -798,8 +798,16 @@
                if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
                        BUG();
                if (nexthdr == NEXTHDR_FRAGMENT) {
-                       struct frag_hdr *fhdr = (struct frag_hdr *) &hdr;
-                       if (ntohs(fhdr->frag_off) & ~0x7)
+                       unsigned short frag_off;
+                       if (skb_copy_bits(skb,
+                                         start+offsetof(struct frag_hdr,
+                                                        frag_off),
+                                         &frag_off,
+                                         sizeof(frag_off))) {
+                               return -1;
+                       }
+
+                       if (ntohs(frag_off) & ~0x7)
                                break;
                        hdrlen = 8;
                } else if (nexthdr == NEXTHDR_AUTH)