Re: [PATCH net-next] ipv6: Fix signed integer overflow in __ip6_append_data

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




在 2022/5/24 11:54, Eric Dumazet 写道:
On Mon, May 23, 2022 at 8:29 PM Wang Yufen <wangyufen@xxxxxxxxxx> wrote:
Resurrect ubsan overflow checks and ubsan report this warning,
fix it by change len check from INT_MAX to IPV6_MAXPLEN.

UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19
2147479552 + 8567 cannot be represented in type 'int'
OK, so why not fix this point, instead of UDP, which is only one of
the possible callers ?

It seems the check in __ip6_append_data() should be unsigned.
.
I modified it based on the IPv4 process:
    udp_sendmsg->ip_append_data->__ip_append_data
The other callers may have the same issue, it would be
more appropriate to change the variable [length]

to size_t in the entire process. I'll try to change it.

Thanks.




[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux