lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[NETFILTER]: nf_conntrack: Fix missing check for ICMPv6 type

Browse Source 
This makes nf_conntrack_icmpv6 check that ICMPv6 type isn't < 128
to avoid accessing out of array valid_new[] and invmap[].

Signed-off-by: Yasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Yasuyuki Kozakai
2005-12-05 13:32:50 -08:00
committed by David S. Miller
parent 8d1ca69984
commit f16c910724
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
View File

@@ -68,8 +68,8 @@ static int icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
[ICMPV6_NI_REPLY - 128] = ICMPV6_NI_REPLY +1 [ICMPV6_NI_REPLY - 128] = ICMPV6_NI_REPLY +1
}; };
__u8 type = orig->dst.u.icmp.type - 128; int type = orig->dst.u.icmp.type - 128;
if (type >= sizeof(invmap) || !invmap[type]) if (type < 0 || type >= sizeof(invmap) || !invmap[type])
return 0; return 0;
tuple->src.u.icmp.id = orig->src.u.icmp.id; tuple->src.u.icmp.id = orig->src.u.icmp.id;
@@ -129,12 +129,12 @@ static int icmpv6_new(struct nf_conn *conntrack,
[ICMPV6_ECHO_REQUEST - 128] = 1, [ICMPV6_ECHO_REQUEST - 128] = 1,
[ICMPV6_NI_QUERY - 128] = 1 [ICMPV6_NI_QUERY - 128] = 1
}; };
int type = conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128;
if (conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128 >= sizeof(valid_new) if (type < 0 || type >= sizeof(valid_new) || !valid_new[type]) {
|| !valid_new[conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128]) {
/* Can't create a new ICMPv6 `conn' with this. */ /* Can't create a new ICMPv6 `conn' with this. */
DEBUGP("icmp: can't create new conn with type %u\n", DEBUGP("icmpv6: can't create new conn with type %u\n",
conntrack->tuplehash[0].tuple.dst.u.icmp.type); type + 128);
NF_CT_DUMP_TUPLE(&conntrack->tuplehash[0].tuple); NF_CT_DUMP_TUPLE(&conntrack->tuplehash[0].tuple);
return 0; return 0;
} }