diff options
| author | Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> | 2023-05-23 08:29:44 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-05-24 08:43:39 +0100 |
| commit | 878ecb0897f4737a4c9401f3523fd49589025671 (patch) | |
| tree | 6dd2f5ec7fe7f198dcc376e27b8c8adc38d6c3ef /net/unix/af_unix.c | |
| parent | Merge tag 'mlx5-fixes-2023-05-22' of git://git.kernel.org/pub/scm/linux/kerne... (diff) | |
| download | linux-878ecb0897f4737a4c9401f3523fd49589025671.tar.gz linux-878ecb0897f4737a4c9401f3523fd49589025671.zip | |
ipv6: Fix out-of-bounds access in ipv6_find_tlv()
optlen is fetched without checking whether there is more than one byte to parse.
It can lead to out-of-bounds access.
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Fixes: c61a40432509 ("[IPV6]: Find option offset by type.")
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions