batman-adv/patches/0001-batman-adv-verify-tt-len-does-not-exceed-packet-len.patch

   1 From e56c79f4e863436d0fc6c48fed0db09b7a49e565 Mon Sep 17 00:00:00 2001
   2 From: Marek Lindner <lindner_marek@yahoo.de>
   3 Date: Mon, 4 Mar 2013 10:39:49 +0800
   4 Subject: [PATCH 1/3] batman-adv: verify tt len does not exceed packet len
   5
   6 batadv_iv_ogm_process() accesses the packet using the tt_num_changes
   7 attribute regardless of the real packet len (assuming the length check
   8 was done before). Therefore a length check is needed to avoid reading
   9 random memory.
  10
  11 Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>
  12 ---
  13  bat_iv_ogm.c |    6 +++---
  14  1 file changed, 3 insertions(+), 3 deletions(-)
  15
  16 diff --git a/bat_iv_ogm.c b/bat_iv_ogm.c
  17 index 72fe1bb..d5be889 100644
  18 --- a/bat_iv_ogm.c
  19 +++ b/bat_iv_ogm.c
  20 @@ -1292,7 +1292,8 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
  21         batadv_ogm_packet = (struct batadv_ogm_packet *)packet_buff;
  22
  23         /* unpack the aggregated packets and process them one by one */
  24 -       do {
  25 +       while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,
  26 +                                        batadv_ogm_packet->tt_num_changes)) {
  27                 tt_buff = packet_buff + buff_pos + BATADV_OGM_HLEN;
  28
  29                 batadv_iv_ogm_process(ethhdr, batadv_ogm_packet, tt_buff,
  30 @@ -1303,8 +1304,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
  31
  32                 packet_pos = packet_buff + buff_pos;
  33                 batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos;
  34 -       } while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,
  35 -                                          batadv_ogm_packet->tt_num_changes));
  36 +       }
  37
  38         kfree_skb(skb);
  39         return NET_RX_SUCCESS;
  40 --
  41 1.7.10.4
  42