| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1212171648-27122-7-git-send-email-allan.stephens@windriver.com> Date: Fri, 30 May 2008 14:20:41 -0400 From: Allan Stephens <allan.stephens@...driver.com> To: David Miller <davem@...emloft.net> Cc: netdev@...r.kernel.org, allan.stephens@...driver.com Subject: [PATCH 06/13 net-next-2.6] [TIPC]: Prevent access of non-existent field in short message header This patch eliminates a case where TIPC's link code could try reading a field that is not present in a short message header. (The random value obtained was not being used, but the read operation could result in an invalid memory access exception in extremely rare circumstances.) Signed-off-by: Allan Stephens <allan.stephens@...driver.com> --- net/tipc/link.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/net/tipc/link.c b/net/tipc/link.c index c62ebfe..022cb2f 100644 --- a/net/tipc/link.c +++ b/net/tipc/link.c @@ -2674,10 +2674,12 @@ int tipc_link_send_long_buf(struct link *l_ptr, struct sk_buff *buf) u32 pack_sz = link_max_pkt(l_ptr); u32 fragm_sz = pack_sz - INT_H_SIZE; u32 fragm_no = 1; - u32 destaddr = msg_destnode(inmsg); + u32 destaddr; if (msg_short(inmsg)) destaddr = l_ptr->addr; + else + destaddr = msg_destnode(inmsg); if (msg_routed(inmsg)) msg_set_prevnode(inmsg, tipc_own_addr); -- 1.5.3.2 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists