/* * netsniff-ng - the packet sniffing beast * Copyright 2009, 2010 Daniel Borkmann. * Subject to the GPL, version 2. */ #ifndef XMALLOC_H #define XMALLOC_H #include #include "built_in.h" #include "die.h" extern void *xmalloc(size_t size) __hidden; extern void *xzmalloc(size_t size) __hidden; extern void *xmallocz(size_t size) __hidden; extern void *xmalloc_aligned(size_t size, size_t alignment) __hidden; extern void *xzmalloc_aligned(size_t size, size_t alignment) __hidden; extern void *xmemdupz(const void *data, size_t len) __hidden; extern void *xrealloc(void *ptr, size_t nmemb, size_t size) __hidden; extern void xfree_func(void *ptr) __hidden; extern char *xstrdup(const char *str) __hidden; extern char *xstrndup(const char *str, size_t size) __hidden; extern int xdup(int fd) __hidden; static inline void __xfree(void *ptr) { if (unlikely((ptr) == NULL)) panic("xfree: NULL pointer given as argument\n"); free(ptr); } #define xfree(ptr) \ do { \ __xfree(ptr); \ (ptr) = NULL; \ } while (0) #endif /* XMALLOC_H */ submit();'> net-next plumbingsTobias Klauser
summaryrefslogtreecommitdiff
path: root/Documentation/i2c/fault-codes
diff options
context:
space:
mode:
authorStefan Richter <stefanr@s5r6.in-berlin.de>2016-10-29 21:28:18 +0200
committerStefan Richter <stefanr@s5r6.in-berlin.de>2016-11-03 14:46:39 +0100
commit667121ace9dbafb368618dbabcf07901c962ddac (patch)
treea73ac08b8ff287151a62bfadc8acf167a3837194 /Documentation/i2c/fault-codes
parent6449e31ddebdce68508cfaf0915d31aad3835f4f (diff)
firewire: net: guard against rx buffer overflows
The IP-over-1394 driver firewire-net lacked input validation when handling incoming fragmented datagrams. A maliciously formed fragment with a respectively large datagram_offset would cause a memcpy past the datagram buffer. So, drop any packets carrying a fragment with offset + length larger than datagram_size. In addition, ensure that - GASP header, unfragmented encapsulation header, or fragment encapsulation header actually exists before we access it, - the encapsulated datagram or fragment is of nonzero size. Reported-by: Eyal Itkin <eyal.itkin@gmail.com> Reviewed-by: Eyal Itkin <eyal.itkin@gmail.com> Fixes: CVE 2016-8633 Cc: stable@vger.kernel.org Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Diffstat (limited to 'Documentation/i2c/fault-codes')