]> git.baikalelectronics.ru Git - kernel.git/commit
dccp: fix out of bound access in dccp_v4_err()
authorEric Dumazet <edumazet@google.com>
Thu, 3 Nov 2016 02:00:40 +0000 (19:00 -0700)
committerDavid S. Miller <davem@davemloft.net>
Thu, 3 Nov 2016 20:16:51 +0000 (16:16 -0400)
commit3b7eda9bde98bb0b93c5903f63b3e173f9026c0c
treecbe6c56ae8eadfb5472dc23fade4158f5e311120
parent3a6b12b81c1ad108e6b0fc4b39dee396fd715cfe
dccp: fix out of bound access in dccp_v4_err()

dccp_v4_err() does not use pskb_may_pull() and might access garbage.

We only need 4 bytes at the beginning of the DCCP header, like TCP,
so the 8 bytes pulled in icmp_socket_deliver() are more than enough.

This patch might allow to process more ICMP messages, as some routers
are still limiting the size of reflected bytes to 28 (RFC 792), instead
of extended lengths (RFC 1812 4.3.2.3)

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/dccp/ipv4.c