d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rip: Add missing minimum length validation in rip_output()

Browse Source 
If the socket is configured such that the sender is expected to supply
the IP header, then we need to verify that it actually did so.

Reported by:	syzkaller+KMSAN
Reviewed by:	donner
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D31302
This commit is contained in:
Mark Johnston 2021-07-26 16:39:18 -04:00
parent accff08c2f
commit ba21825202
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/netinet/raw_ip.c
View File

@ -523,8 +523,15 @@ rip_output(struct mbuf *m, struct socket *so, ...)
} else {
if (m->m_pkthdr.len > IP_MAXPACKET) {
m_freem(m);
return(EMSGSIZE);
return (EMSGSIZE);
}
if (m->m_pkthdr.len < sizeof(*ip)) {
m_freem(m);
return (EINVAL);
}
m = m_pullup(m, sizeof(*ip));
if (m == NULL)
return (ENOMEM);
ip = mtod(m, struct ip *);
hlen = ip->ip_hl << 2;
if (m->m_len < hlen) {