Attachment 23949 Details for Bug 61016

[patch] Updated patch

netfilter-ipt-log-crash (text/plain), 1.67 KB, created by Olaf Kirch on 2004-09-24 21:51:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Olaf Kirch

Created: 2004-09-24 21:51:10 UTC

Size: 1.67 KB

patch

obsolete

>Subject: Prevent ICMP crash in netfilter logging
>From: Olaf Kirch <okir@suse.de>
>References: 46016
>
>This patch fixes a remotely triggerable crash in the netfilter code
>when looking at ICMP unreachables. It dies when trying to copy
>((unsigned int) -20) bytes...
>
>Index: linux-2.6.5/net/ipv4/netfilter/ipt_LOG.c
>===================================================================
>--- linux-2.6.5.orig/net/ipv4/netfilter/ipt_LOG.c	2004-02-19 11:36:37.000000000 +0100
>+++ linux-2.6.5/net/ipv4/netfilter/ipt_LOG.c	2004-09-24 15:48:54.000000000 +0200
>@@ -71,7 +71,7 @@
> 		printk("FRAG:%u ", ntohs(iph.frag_off) & IP_OFFSET);
> 
> 	if ((info->logflags & IPT_LOG_IPOPT)
>-	    && iph.ihl * 4 != sizeof(struct iphdr)) {
>+	    && iph.ihl * 4 > sizeof(struct iphdr)) {
> 		unsigned char opt[4 * 15 - sizeof(struct iphdr)];
> 		unsigned int i, optsize;
> 
>@@ -138,7 +138,7 @@
> 		printk("URGP=%u ", ntohs(tcph.urg_ptr));
> 
> 		if ((info->logflags & IPT_LOG_TCPOPT)
>-		    && tcph.doff * 4 != sizeof(struct tcphdr)) {
>+		    && tcph.doff * 4 > sizeof(struct tcphdr)) {
> 			unsigned char opt[4 * 15 - sizeof(struct tcphdr)];
> 			unsigned int i, optsize;
> 
>Index: linux-2.6.5/net/ipv6/netfilter/ip6t_LOG.c
>===================================================================
>--- linux-2.6.5.orig/net/ipv6/netfilter/ip6t_LOG.c	2004-09-24 15:47:00.000000000 +0200
>+++ linux-2.6.5/net/ipv6/netfilter/ip6t_LOG.c	2004-09-24 15:48:35.000000000 +0200
>@@ -188,7 +188,7 @@
> 		printk("URGP=%u ", ntohs(tcph->urg_ptr));
> 
> 		if ((info->logflags & IP6T_LOG_TCPOPT)
>-		    && tcph->doff * 4 != sizeof(struct tcphdr)) {
>+		    && tcph->doff * 4 > sizeof(struct tcphdr)) {
> 			unsigned int i;
> 
> 			/* Max length: 127 "OPT (" 15*4*2chars ") " */

Actions: View | Diff

Attachments on bug 61016: 23931 | 23938 | 23940 | 23941 | 23949