Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753443Ab0HGTRz (ORCPT ); Sat, 7 Aug 2010 15:17:55 -0400 Received: from mail-qy0-f181.google.com ([209.85.216.181]:34831 "EHLO mail-qy0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752728Ab0HGTRy (ORCPT ); Sat, 7 Aug 2010 15:17:54 -0400 MIME-Version: 1.0 X-Originating-IP: [94.237.226.193] Date: Sat, 7 Aug 2010 23:17:52 +0400 Message-ID: Subject: [PATCH] tcp: no md5sig option size check bug From: Dmitry Popov To: "David S. Miller" , Alexey Kuznetsov , James Morris , Patrick McHardy , Hideaki YOSHIFUJI Cc: "Pekka Savola (ipv6)" , Gilad Ben-Yossef , Yony Amit , Ori Finkelman , =?ISO-8859-1?Q?Ilpo_J=E4rvinen?= , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 986 Lines: 28 From: Dmitry Popov tcp_parse_md5sig_option doesn't check md5sig option (TCPOPT_MD5SIG) length, but tcp_v[46]_inbound_md5_hash assume that it's at least 16 bytes long. Signed-off-by: Dmitry Popov --- net/ipv4/tcp_input.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 3c426cb..e663b78 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -3930,7 +3930,7 @@ u8 *tcp_parse_md5sig_option(struct tcphdr *th) if (opsize < 2 || opsize > length) return NULL; if (opcode == TCPOPT_MD5SIG) - return ptr; + return opsize == TCPOLEN_MD5SIG ? ptr : NULL; } ptr += opsize - 2; length -= opsize; -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/