Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 26 Jul 2021 20:54:47 GMT
From:      Mark Johnston <markj@FreeBSD.org>
To:        src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org
Subject:   git: ba2182520273 - main - rip: Add missing minimum length validation in rip_output()
Message-ID:  <202107262054.16QKslN3079997@gitrepo.freebsd.org>

next in thread | raw e-mail | index | archive | help
The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=ba21825202737a8b7e90e1ef669c7fe7e7d50325

commit ba21825202737a8b7e90e1ef669c7fe7e7d50325
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2021-07-26 20:39:18 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2021-07-26 20:39:37 +0000

    rip: Add missing minimum length validation in rip_output()
    
    If the socket is configured such that the sender is expected to supply
    the IP header, then we need to verify that it actually did so.
    
    Reported by:    syzkaller+KMSAN
    Reviewed by:    donner
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D31302
---
 sys/netinet/raw_ip.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 1db73a6da68c..996440227145 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -523,8 +523,15 @@ rip_output(struct mbuf *m, struct socket *so, ...)
 	} else {
 		if (m->m_pkthdr.len > IP_MAXPACKET) {
 			m_freem(m);
-			return(EMSGSIZE);
+			return (EMSGSIZE);
 		}
+		if (m->m_pkthdr.len < sizeof(*ip)) {
+			m_freem(m);
+			return (EINVAL);
+		}
+		m = m_pullup(m, sizeof(*ip));
+		if (m == NULL)
+			return (ENOMEM);
 		ip = mtod(m, struct ip *);
 		hlen = ip->ip_hl << 2;
 		if (m->m_len < hlen) {



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202107262054.16QKslN3079997>