lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sat, 26 Jul 2008 08:03:08 +0100
From:	Gerrit Renker <>
To:	David Miller <>
Subject: Re: [RFC] sctp/tcp: Question -- ICMPv4 length check (not)

| >  * icmp_unreach() in net/ipv4/icmp.c already has this test:
| > 
| > 	/* Checkin full IP header plus 8 bytes of protocol to
| > 	 * avoid additional coding at protocol handlers.
| > 	 */
| >         if (!pskb_may_pull(skb, iph->ihl * 4 + 8))
| >                 goto out;
| I just noticed that this won't bump the ICMP MIB counter.
| The ICMP code will only bump the counter if the IP header isn't there,
| or has a bogus header length.
| But it is clear in the callers that the intention is (or was) to bump
| the counter if the 8 bytes of post IP header bits are not there.
If `goto out' is replaced with `goto out_err' in icmp_unreach(),
it may be worth considering the analogous case in icmpv6_notify():

	/* Checkin header including 8 bytes of inner protocol header. */
        if (!pskb_may_pull(skb, inner_offset+8))

and the `discard_it' jump label in icmpv6_rcv().
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists