Ensure that IP fragments do not extend beyond IP_MAXPACKET.
Such fragments are obviously invalid, and when processed may end up violating the sort order (by offset) of fragments of a given packet. This doesn't appear to be exploitable, however. Reviewed by: emaste Discussed with: jtl MFC after: 3 days Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D17914
This commit is contained in:
parent
266b2aa146
commit
86af1d0241
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=340313
@ -227,6 +227,16 @@ ip_reass(struct mbuf *m)
|
||||
m->m_flags &= ~M_IP_FRAG;
|
||||
ip->ip_off = htons(ntohs(ip->ip_off) << 3);
|
||||
|
||||
/*
|
||||
* Make sure the fragment lies within a packet of valid size.
|
||||
*/
|
||||
if (ntohs(ip->ip_len) + ntohs(ip->ip_off) > IP_MAXPACKET) {
|
||||
IPSTAT_INC(ips_toolong);
|
||||
IPSTAT_INC(ips_fragdropped);
|
||||
m_freem(m);
|
||||
return (NULL);
|
||||
}
|
||||
|
||||
/*
|
||||
* Attempt reassembly; if it succeeds, proceed.
|
||||
* ip_reass() will return a different mbuf.
|
||||
|
Loading…
Reference in New Issue
Block a user