Re: [PATCH] net: check the length of the data before dereferencing it

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

On Mon, 2012-04-02 at 11:45 +0800, Changli Gao wrote:

> Thinking about a malformed tcp segment, which has no data but silly
> options, and whose last byte is neither TCPOPT_EOL or TCPOPT_NOP, we
> will try to dereference one byte over the boundary when parsing the
> options. I know we have skb_shared_info at the end and it won't cause
> any crash, but should we rely on this fact?

No we cant rely on this, kmemcheck might barf on us.

Your patch (and the netfilter one) is fine.

To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at

[Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]     [Photo]

Powered by Linux