Date: Wed, 4 Nov 2015 10:42:51 +0000 (UTC) From: "Andrey V. Elsukov" <ae@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r290360 - stable/10/sys/net Message-ID: <201511041042.tA4AgpkN052587@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: ae Date: Wed Nov 4 10:42:51 2015 New Revision: 290360 URL: https://svnweb.freebsd.org/changeset/base/290360 Log: MFC r290116: Check the size of data available in mbuf before using it. PR: 202667 Modified: stable/10/sys/net/if_gre.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/net/if_gre.c ============================================================================== --- stable/10/sys/net/if_gre.c Wed Nov 4 10:35:10 2015 (r290359) +++ stable/10/sys/net/if_gre.c Wed Nov 4 10:42:51 2015 (r290360) @@ -691,6 +691,14 @@ gre_input(struct mbuf **mp, int *offp, i KASSERT(sc != NULL, ("encap_getarg returned NULL")); ifp = GRE2IFP(sc); + hlen = *offp + sizeof(struct grehdr) + 4 * sizeof(uint32_t); + if (m->m_pkthdr.len < hlen) + goto drop; + if (m->m_len < hlen) { + m = m_pullup(m, hlen); + if (m == NULL) + goto drop; + } gh = (struct grehdr *)mtodo(m, *offp); flags = ntohs(gh->gre_flags); if (flags & ~GRE_FLAGS_MASK)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201511041042.tA4AgpkN052587>