Date: Sat, 9 Apr 2011 10:58:38 +0000 (UTC) From: "Bjoern A. Zeeb" <bz@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org Subject: svn commit: r220484 - stable/7/sys/netipsec Message-ID: <201104091058.p39AwcoG011594@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: bz Date: Sat Apr 9 10:58:38 2011 New Revision: 220484 URL: http://svn.freebsd.org/changeset/base/220484 Log: MFC r220247: Do not allow directly recursive RFC3173 IPComp payload. Security: CVE-2011-1547 Modified: stable/7/sys/netipsec/xform_ipcomp.c Directory Properties: stable/7/sys/ (props changed) stable/7/sys/cddl/contrib/opensolaris/ (props changed) stable/7/sys/contrib/dev/acpica/ (props changed) stable/7/sys/contrib/pf/ (props changed) Modified: stable/7/sys/netipsec/xform_ipcomp.c ============================================================================== --- stable/7/sys/netipsec/xform_ipcomp.c Sat Apr 9 10:53:36 2011 (r220483) +++ stable/7/sys/netipsec/xform_ipcomp.c Sat Apr 9 10:58:38 2011 (r220484) @@ -139,10 +139,31 @@ ipcomp_input(struct mbuf *m, struct seca struct tdb_crypto *tc; struct cryptodesc *crdc; struct cryptop *crp; + struct ipcomp *ipcomp; + caddr_t addr; int hlen = IPCOMP_HLENGTH; IPSEC_SPLASSERT_SOFTNET(__func__); + /* + * Check that the next header of the IPComp is not IPComp again, before + * doing any real work. Given it is not possible to do double + * compression it means someone is playing tricks on us. + */ + if (m->m_len < skip + hlen && (m = m_pullup(m, skip + hlen)) == NULL) { + ipcompstat.ipcomps_hdrops++; /*XXX*/ + DPRINTF(("%s: m_pullup failed\n", __func__)); + return (ENOBUFS); + } + addr = (caddr_t) mtod(m, struct ip *) + skip; + ipcomp = (struct ipcomp *)addr; + if (ipcomp->comp_nxt == IPPROTO_IPCOMP) { + m_freem(m); + ipcompstat.ipcomps_pdrops++; /* XXX have our own stats? */ + DPRINTF(("%s: recursive compression detected\n", __func__)); + return (EINVAL); + } + /* Get crypto descriptors */ crp = crypto_getreq(1); if (crp == NULL) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201104091058.p39AwcoG011594>