firewire: net: guard against rx buffer overflows
authorStefan Richter <stefanr@s5r6.in-berlin.de>
Sat, 29 Oct 2016 19:28:18 +0000 (21:28 +0200)
committerStefan Richter <stefanr@s5r6.in-berlin.de>
Thu, 3 Nov 2016 13:46:39 +0000 (14:46 +0100)
commit667121ace9dbafb368618dbabcf07901c962ddac
treea73ac08b8ff287151a62bfadc8acf167a3837194
parent6449e31ddebdce68508cfaf0915d31aad3835f4f
firewire: net: guard against rx buffer overflows

The IP-over-1394 driver firewire-net lacked input validation when
handling incoming fragmented datagrams.  A maliciously formed fragment
with a respectively large datagram_offset would cause a memcpy past the
datagram buffer.

So, drop any packets carrying a fragment with offset + length larger
than datagram_size.

In addition, ensure that
  - GASP header, unfragmented encapsulation header, or fragment
    encapsulation header actually exists before we access it,
  - the encapsulated datagram or fragment is of nonzero size.

Reported-by: Eyal Itkin <eyal.itkin@gmail.com>
Reviewed-by: Eyal Itkin <eyal.itkin@gmail.com>
Fixes: CVE 2016-8633
Cc: stable@vger.kernel.org
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
drivers/firewire/net.c