summaryrefslogtreecommitdiff
path: root/net/ipv6/esp6.c
diff options
context:
space:
mode:
authorJordy Zomer <jordy@pwning.systems>2021-11-17 20:06:48 +0100
committerDavid S. Miller <davem@davemloft.net>2021-11-18 11:42:06 +0000
commit5f9c55c8066bcd93ac25234a02585701fe2e31df (patch)
tree9cfd5b6e77e0bde6d275d7414fb0d321929b9cec /net/ipv6/esp6.c
parent5d2ca2e12dfb2aff3388ca57b06f570fa6206ced (diff)
ipv6: check return value of ipv6_skip_exthdr
The offset value is used in pointer math on skb->data. Since ipv6_skip_exthdr may return -1 the pointer to uh and th may not point to the actual udp and tcp headers and potentially overwrite other stuff. This is why I think this should be checked. EDIT: added {}'s, thanks Kees Signed-off-by: Jordy Zomer <jordy@pwning.systems> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/esp6.c')
-rw-r--r--net/ipv6/esp6.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index ed2f061b8768..f0bac6f7ab6b 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -808,6 +808,12 @@ int esp6_input_done2(struct sk_buff *skb, int err)
struct tcphdr *th;
offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
+
+ if (offset < 0) {
+ err = -EINVAL;
+ goto out;
+ }
+
uh = (void *)(skb->data + offset);
th = (void *)(skb->data + offset);
hdr_len += offset;