netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options
authorJozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Wed, 30 Mar 2016 09:34:35 +0000 (11:34 +0200)
committerPablo Neira Ayuso <pablo@netfilter.org>
Thu, 7 Apr 2016 16:42:37 +0000 (18:42 +0200)
commit644c7e48cb59cfc6988ddc7bf3d3b1ba5fe7fa9d
treecb2ca7427bab0e28fe097ae6a08acd416c63eccd
parentff76def3bd7e816fe0ca7f0840065c566a42ba2f
netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options

Baozeng Ding reported a KASAN stack out of bounds issue - it uncovered that
the TCP option parsing routines in netfilter TCP connection tracking could
read one byte out of the buffer of the TCP options.  Therefore in the patch
we check that the available data length is large enough to parse both TCP
option code and size.

Reported-by: Baozeng Ding <sploving1@gmail.com>
Tested-by: Baozeng Ding <sploving1@gmail.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_conntrack_proto_tcp.c