diff mbox series

[API-NEXT,v6,14/15] linux-gen: ipsec: validate ip header total length

Message ID 1509710415-8980-15-git-send-email-odpbot@yandex.ru
State Superseded
Headers show
Series [API-NEXT,v6,1/15] linux-gen: ipsec: use counter instead of random IV for GCM | expand

Commit Message

Github ODP bot Nov. 3, 2017, noon UTC 
From: Dmitry Eremin-Solenikov <dmitry.ereminsolenikov@linaro.org>


Check that IP packet length from the header is not bogus.

Signed-off-by: Dmitry Eremin-Solenikov <dmitry.ereminsolenikov@linaro.org>

---
/** Email created from pull request 243 (lumag:ipsec-packet-impl-3)
 ** https://github.com/Linaro/odp/pull/243
 ** Patch: https://github.com/Linaro/odp/pull/243.patch
 ** Base sha: d22c949cc466bf28de559855a1cb525740578137
 ** Merge commit sha: c7cf7a3e9184b27986b3ddb459d86081b1fca033
 **/
 platform/linux-generic/odp_ipsec.c | 10 ++++++++++
 1 file changed, 10 insertions(+)
diff mbox series

Patch

diff --git a/platform/linux-generic/odp_ipsec.c b/platform/linux-generic/odp_ipsec.c
index 8101b00c6..e6fb276a6 100644
--- a/platform/linux-generic/odp_ipsec.c
+++ b/platform/linux-generic/odp_ipsec.c
@@ -300,6 +300,11 @@  static ipsec_sa_t *ipsec_in_single(odp_packet_t pkt,
 
 	ipsec_offset = ip_offset + ip_hdr_len;
 
+	if (odp_be_to_cpu_16(ip->tot_len) + ip_offset > odp_packet_len(pkt)) {
+		status->error.alg = 1;
+		goto err;
+	}
+
 	if (_ODP_IPV4HDR_IS_FRAGMENT(odp_be_to_cpu_16(ip->frag_offset))) {
 		status->error.proto = 1;
 		goto err;
@@ -648,6 +653,11 @@  static ipsec_sa_t *ipsec_out_single(odp_packet_t pkt,
 		goto err;
 	}
 
+	if (odp_be_to_cpu_16(ip->tot_len) + ip_offset > odp_packet_len(pkt)) {
+		status->error.alg = 1;
+		goto err;
+	}
+
 	if (ODP_IPSEC_MODE_TUNNEL == ipsec_sa->mode) {
 		_odp_ipv4hdr_t out_ip;
 		uint16_t tot_len;