diff options
| author |   Dan Carpenter <dan.carpenter@oracle.com> | 2020-06-30 14:46:15 +0300 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2020-06-30 18:36:13 -0700 |
| commit | 8ff41cc21714704ef0158a546c3c4d07fae2c952 (patch) | |
| tree | 455655ae7ad1e53174166f45a484c2b3812786e8 /include | |
| parent | tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key() (diff) | |
| download | wireguard-linux-8ff41cc21714704ef0158a546c3c4d07fae2c952.tar.xz wireguard-linux-8ff41cc21714704ef0158a546c3c4d07fae2c952.zip | |
net: qrtr: Fix an out of bounds read qrtr_endpoint_post()
This code assumes that the user passed in enough data for a
qrtr_hdr_v1 or qrtr_hdr_v2 struct, but it's not necessarily true. If
the buffer is too small then it will read beyond the end.
Reported-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reported-by: syzbot+b8fe393f999a291a9ea6@syzkaller.appspotmail.com
Fixes: 194ccc88297a ("net: qrtr: Support decoding incoming v2 packets")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions