6LoWPAN reassembly fragment overlap checks. Signed-off-by: Rafael Vuijk <r.vuijk@xxxxxxxxx> --- ./net/ieee802154/6lowpan/reassembly.c 2018-02-20 11:10:06.000000000 +0100 +++ ./net/ieee802154/6lowpan/reassembly.c 2018-02-21 09:13:29.000000000 +0100 @@ -179,6 +170,13 @@ static int lowpan_frag_queue(struct lowp } found: + /* Current fragment overlaps with previous fragment? */ + if (prev && (lowpan_802154_cb(prev)->d_offset << 3) + prev->len > offset) + goto err; + /* Current fragment overlaps with next fragment? */ + if (next && offset + skb->len > lowpan_802154_cb(next)->d_offset << 3) + goto err; + /* Insert this fragment in the chain of fragments. */ skb->next = next; if (!next) -- To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
