Date: Sat, 4 May 2019 10:13:38 +0000 (UTC) From: Michael Tuexen <tuexen@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r347093 - stable/12/sys/netinet Message-ID: <201905041013.x44ADc79003065@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tuexen Date: Sat May 4 10:13:37 2019 New Revision: 347093 URL: https://svnweb.freebsd.org/changeset/base/347093 Log: MFC r344048: Improve input validation for raw IPv4 socket using the IP_HDRINCL option. This issue was found by running syzkaller on OpenBSD. Greg Steuck made me aware that the problem might also exist on FreeBSD. Reported by: Greg Steuck Differential Revision: https://reviews.freebsd.org/D18834 Modified: stable/12/sys/netinet/raw_ip.c Directory Properties: stable/12/ (props changed) Modified: stable/12/sys/netinet/raw_ip.c ============================================================================== --- stable/12/sys/netinet/raw_ip.c Sat May 4 10:09:25 2019 (r347092) +++ stable/12/sys/netinet/raw_ip.c Sat May 4 10:13:37 2019 (r347093) @@ -454,6 +454,8 @@ rip_output(struct mbuf *m, struct socket *so, ...) u_long dst; int flags = ((so->so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0) | IP_ALLOWBROADCAST; + int cnt; + u_char opttype, optlen, *cp; va_start(ap, so); dst = va_arg(ap, u_long); @@ -527,6 +529,34 @@ rip_output(struct mbuf *m, struct socket *so, ...) INP_RUNLOCK(inp); m_freem(m); return (EINVAL); + } + /* + * Don't allow IP options which do not have the required + * structure as specified in section 3.1 of RFC 791 on + * pages 15-23. + */ + cp = (u_char *)(ip + 1); + cnt = (ip->ip_hl << 2) - sizeof (struct ip); + for (; cnt > 0; cnt -= optlen, cp += optlen) { + opttype = cp[IPOPT_OPTVAL]; + if (opttype == IPOPT_EOL) + break; + if (opttype == IPOPT_NOP) { + optlen = 1; + continue; + } + if (cnt < IPOPT_OLEN + sizeof(u_char)) { + INP_RUNLOCK(inp); + m_freem(m); + return (EINVAL); + } + optlen = cp[IPOPT_OLEN]; + if (optlen < IPOPT_OLEN + sizeof(u_char) || + optlen > cnt) { + INP_RUNLOCK(inp); + m_freem(m); + return (EINVAL); + } } /* * This doesn't allow application to specify ID of zero,
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201905041013.x44ADc79003065>