Please sign in to comment.
firewire: net: guard against rx buffer overflows
The IP-over-1394 driver firewire-net lacked input validation when handling incoming fragmented datagrams. A maliciously formed fragment with a respectively large datagram_offset would cause a memcpy past the datagram buffer. So, drop any packets carrying a fragment with offset + length larger than datagram_size. In addition, ensure that - GASP header, unfragmented encapsulation header, or fragment encapsulation header actually exists before we access it, - the encapsulated datagram or fragment is of nonzero size. Reported-by: Eyal Itkin <email@example.com> Reviewed-by: Eyal Itkin <firstname.lastname@example.org> Fixes: CVE 2016-8633 Cc: email@example.com Signed-off-by: Stefan Richter <firstname.lastname@example.org>
- Loading branch information...