summaryrefslogtreecommitdiff
path: root/include/net/raw.h
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2017-02-04 23:18:55 -0800
committerDavid S. Miller <davem@davemloft.net>2017-02-05 17:23:04 -0500
commit7892032cfe67f4bde6fc2ee967e45a8fbaf33756 (patch)
treecbadc1cb0484fbdcd3d5d68d5189c1d022d0d0d4 /include/net/raw.h
parentd71b7896886345c53ef1d84bda2bc758554f5d61 (diff)
ip6_gre: fix ip6gre_err() invalid reads
Andrey Konovalov reported out of bound accesses in ip6gre_err() If GRE flags contains GRE_KEY, the following expression *(((__be32 *)p) + (grehlen / 4) - 1) accesses data ~40 bytes after the expected point, since grehlen includes the size of IPv6 headers. Let's use a "struct gre_base_hdr *greh" pointer to make this code more readable. p[1] becomes greh->protocol. grhlen is the GRE header length. Fixes: c12b395a4664 ("gre: Support GRE over IPv6") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Andrey Konovalov <andreyknvl@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net/raw.h')
0 files changed, 0 insertions, 0 deletions