diff options
| author | liucheng (G) <liucheng32@huawei.com> | 2019-08-29 13:47:33 +0000 |
|---|---|---|
| committer | Joe Hershberger <joe.hershberger@ni.com> | 2019-09-04 11:37:19 -0500 |
| commit | fe7288069d2e6659117049f7d27e261b550bb725 (patch) | |
| tree | c68947cedb27841b166023d3a68377056f1a4db2 | |
| parent | 12c2a310e87d4eacfd669346338e856cb3ad54c2 (diff) | |
| download | u-boot-fe7288069d2e6659117049f7d27e261b550bb725.tar.gz u-boot-fe7288069d2e6659117049f7d27e261b550bb725.tar.xz u-boot-fe7288069d2e6659117049f7d27e261b550bb725.zip | |
CVE: net: fix unbounded memcpy of UDP packet
This patch adds a check to udp_len to fix unbounded memcpy for
CVE-2019-14192, CVE-2019-14193 and CVE-2019-14199.
Signed-off-by: Cheng Liu <liucheng32@huawei.com>
Reviewed-by: Simon Goldschmidt <simon.k.r.goldschmidt@gmail.com>
Reported-by: FermÃn Serna <fermin@semmle.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
| -rw-r--r-- | net/net.c | 3 |
1 files changed, 3 insertions, 0 deletions
@@ -1264,6 +1264,9 @@ void net_process_received_packet(uchar *in_packet, int len) return; } + if (ntohs(ip->udp_len) < UDP_HDR_SIZE || ntohs(ip->udp_len) > ntohs(ip->ip_len)) + return; + debug_cond(DEBUG_DEV_PKT, "received UDP (to=%pI4, from=%pI4, len=%d)\n", &dst_ip, &src_ip, len); |