From patchwork Mon Mar 4 02:43:30 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marek Lindner X-Patchwork-Id: 2761 X-Patchwork-Delegate: mareklindner@neomailbox.ch Return-Path: Received: from nm37-vm8.bullet.mail.sg3.yahoo.com (nm37-vm8.bullet.mail.sg3.yahoo.com [106.10.151.127]) by open-mesh.org (Postfix) with SMTP id 02F26601D59 for ; Mon, 4 Mar 2013 03:43:41 +0100 (CET) Received: from [106.10.166.119] by nm37.bullet.mail.sg3.yahoo.com with NNFMP; 04 Mar 2013 02:43:39 -0000 Received: from [106.10.167.170] by tm8.bullet.mail.sg3.yahoo.com with NNFMP; 04 Mar 2013 02:43:39 -0000 Received: from [127.0.0.1] by smtp143.mail.sg3.yahoo.com with NNFMP; 04 Mar 2013 02:43:39 -0000 X-Yahoo-Newman-Id: 856859.60132.bm@smtp143.mail.sg3.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: axMTi8cVM1nSwWIubTSMDxjm_m7fO2RHn05XGNCxxLgj5Ck 5cuZRqzztPVqGWM9bPiDG4UtA6ZqiKKenhLEzEsL00kAFWIW1VIdc4D6gBwf UNdO9yjfBAbrU8NeyHMdswxp5Wx4YKLs0bGeFBE0hYd6H2e0JhX7h23YTJV1 F1cuwg3nfMdl.AMuq07oChAdTcHXQxWy2Nl3jRvLaN8f9w_eMqqvnglvWhE2 eGWuoeTpOcOjjUULBGJFKRAJWrvXSfgfLQM.NUMwdjmpLOUFrUxpUTizROJt jEjSS51vlst3KwFFNkrD8h.3ux1I97NmnIXL_H2Jz7l6aREGNHPFIe9he_x_ GGK2y4dJO5in5Jb3lIdLkwJyas57OIE.1sz2XwDYAfTrA6zJdT_Ui52IPayf oV9FZS.eNy_BsCKnn78BysvUqyMRTU5Vd9bxyW6K3AarBwQ0- X-Yahoo-SMTP: tW.h3tiswBBMXO2coYcbPigGD5Lt6zY_.Zc- Received: from localhost (lindner_marek@42.98.197.135 with plain) by smtp143.mail.sg3.yahoo.com with SMTP; 03 Mar 2013 18:43:39 -0800 PST From: Marek Lindner To: b.a.t.m.a.n@lists.open-mesh.org Date: Mon, 4 Mar 2013 10:43:30 +0800 Message-Id: <1362365010-21698-1-git-send-email-lindner_marek@yahoo.de> X-Mailer: git-send-email 1.7.10.4 Cc: Marek Lindner Subject: [B.A.T.M.A.N.] [PATCH] batman-adv: verify whether tt len exceeds packet len upon receipt of OGM X-BeenThere: b.a.t.m.a.n@lists.open-mesh.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: The list for a Better Approach To Mobile Ad-hoc Networking List-Id: The list for a Better Approach To Mobile Ad-hoc Networking List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Mar 2013 02:43:43 -0000 Signed-off-by: Marek Lindner --- bat_iv_ogm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/bat_iv_ogm.c b/bat_iv_ogm.c index 7654b76..99cab3b 100644 --- a/bat_iv_ogm.c +++ b/bat_iv_ogm.c @@ -1272,7 +1272,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb, struct batadv_priv *bat_priv = netdev_priv(if_incoming->soft_iface); struct batadv_ogm_packet *batadv_ogm_packet; struct ethhdr *ethhdr; - int buff_pos = 0, packet_len; + int buff_pos = 0, tt_len, packet_len; unsigned char *tt_buff, *packet_buff; bool ret; uint8_t *packet_pos; @@ -1298,14 +1298,17 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb, /* unpack the aggregated packets and process them one by one */ do { + tt_len = batadv_tt_len(batadv_ogm_packet->tt_num_changes); + + if (buff_pos + BATADV_OGM_HLEN + tt_len > packet_len) + break; + tt_buff = packet_buff + buff_pos + BATADV_OGM_HLEN; batadv_iv_ogm_process(ethhdr, batadv_ogm_packet, tt_buff, if_incoming); - buff_pos += BATADV_OGM_HLEN; - buff_pos += batadv_tt_len(batadv_ogm_packet->tt_num_changes); - + buff_pos += BATADV_OGM_HLEN + tt_len; packet_pos = packet_buff + buff_pos; batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos; } while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,