projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 025c65e) | patch
xfrm4: Fix uninitialized memory read in _decode_session4
authorSteffen Klassert <steffen.klassert@secunet.com>
Tue, 26 Feb 2019 06:04:50 +0000 (07:04 +0100)
committerSteffen Klassert <steffen.klassert@secunet.com>
Tue, 2 Apr 2019 06:18:39 +0000 (08:18 +0200)
commit8742dc86d0c7a9628117a989c11f04a9b6b898f3
tree728af98f0cc36df61525fc5958f188d825fc5bc6tree | snapshot
parent025c65e119bf58b610549ca359c9ecc5dee6a8d2commit | diff
xfrm4: Fix uninitialized memory read in _decode_session4

We currently don't reload pointers pointing into skb header
after doing pskb_may_pull() in _decode_session4(). So in case
pskb_may_pull() changed the pointers, we read from random
memory. Fix this by putting all the needed infos on the
stack, so that we don't need to access the header pointers
after doing pskb_may_pull().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/ipv4/xfrm4_policy.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git