• A
    x25: possible skb leak on bad facilities · 95c30430
    andrew hendry 提交于
    Originally x25_parse_facilities returned
    -1 for an error
     0 meaning 0 length facilities
    >0 the length of the facilities parsed.
    
    5ef41308 ("x25: Prevent crashing when parsing bad X.25 facilities") introduced more
    error checking in x25_parse_facilities however used 0 to indicate bad parsing
    a6331d6f ("memory corruption in X.25 facilities parsing") followed this further for
    DTE facilities, again using 0 for bad parsing.
    
    The meaning of 0 got confused in the callers.
    If the facilities are messed up we can't determine where the data starts.
    So patch makes all parsing errors return -1 and ensures callers close and don't use the skb further.
    Reported-by: NAndy Whitcroft <apw@canonical.com>
    Signed-off-by: NAndrew Hendry <andrew.hendry@gmail.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    95c30430
x25_in.c 9.1 KB