openharmony/kernel_linux_common_modules
1
0
Fork 0
mirror of https://github.com/openharmony/kernel_linux_common_modules.git synced 2026-08-26 17:16:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

!42 解决skb_len翻转导致的读越界

Browse Source 
Merge pull request !42 from liangbotong/master
This commit is contained in:
openharmony_ci
2023-09-01 01:52:19 +00:00
committed by Gitee
parent c166b84a9a 65eed81296
commit 4e21b4b83d
4 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
newip/src/common/nip_hdr.h
+2 -1
View File
@@ -34,7 +34,8 @@
*/
#define NIP_HDR_MAX 24
#define NIP_UDP_HDR_LEN 8
#define NIP_MIN_MTU (NIP_HDR_MAX + 20) // NewIP hdr + TCP hdr
#define NIP_TCP_HDR_LEN 20
#define NIP_MIN_MTU (NIP_HDR_MAX + NIP_TCP_HDR_LEN)
#define NIP_BYTE_ALIGNMENT 2
#define NIP_BITMAP_HAVE_MORE_BIT 0x01
newip/third_party/linux-5.10/net/newip/nip_input.c
Vendored
+1 -1
View File
@@ -101,7 +101,7 @@ int nip_rcv(struct sk_buff *skb, struct net_device *dev,
memset(nipcb(skb), 0, sizeof(struct ninet_skb_parm));
offset = nip_hdr_parse(skb->data, skb->len, &niph);
if (offset <= 0) {
if (offset <= 0 || offset > skb->len) {
nip_dbg("check in failure, errcode=%d, Drop a packet (nexthdr=%u, hdr_len=%u)",
offset, niph.nexthdr, niph.hdr_len);
goto drop;
newip/third_party/linux-5.10/net/newip/tcp_nip.c
Vendored
+2
View File
@@ -1758,6 +1758,8 @@ static int tcp_nip_rcv(struct sk_buff *skb)
nip_dbg("non-four byte alignment, drop skb");
goto discard_it;
}
if (!pskb_may_pull(skb, th->doff * 4))
goto discard_it;
sk = __ninet_lookup_skb(&tcp_hashinfo, skb, __tcp_hdrlen(th),
th->source, th->dest, dif, &refcounted);
newip/third_party/linux-5.10/net/newip/tcp_nip_input.c
Vendored
+5 -1
View File
@@ -1379,7 +1379,8 @@ static void tcp_nip_dup_ack_retrans(struct sock *sk, const struct sk_buff *skb,
*/
int mss = tcp_nip_current_mss(sk);
struct tcphdr *th = (struct tcphdr *)skb->data;
u16 discard_num = htons(th->urg_ptr);
u16 discard_num = htons(th->urg_ptr) > PKT_DISCARD_MAX ?
0 : htons(th->urg_ptr);
u32 last_nip_ssthresh = ntp->nip_ssthresh;
if (tp->selective_acks[0].end_seq)
@@ -1730,6 +1731,9 @@ void tcp_nip_rcv_established(struct sock *sk, struct sk_buff *skb,
if (unlikely(!rcu_access_pointer(sk->sk_rx_dst)))
inet_csk(sk)->icsk_af_ops->sk_rx_dst_set(sk, skb);
if (skb->len < (th->doff << 2))
return;
if (!tcp_nip_validate_incoming(sk, skb, th, 1))
return;