ipmr: off by one in __ipmr_fill_mroute()

PATCH Applied Dan Carpenter 2 participants 2 messages May 22, 2010 – May 26, 2010

Subsystems (3)

Networking Network drivers IPv4/IPv6

lore

Share & tools

lore

Dan Carpenter

author

2010-05-22 17:55 UTC #0 lore raw

PATCH 1/1 ipmr: off by one in __ipmr_fill_mroute()

This fixes a smatch warning:

	net/ipv4/ipmr.c +1917 __ipmr_fill_mroute(12) error: buffer overflow
	'(mrt)->vif_table' 32 <= 32

The ipv6 version had the same issue.

Signed-off-by Dan Carpenter <[email protected]>

net/ipv4/ipmr.c +1 -1

index 4588910..856123f 100644
@@ -1911,7 +1911,7 @@ static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
 	struct rtattr *mp_head;
 
 	/* If cache is unresolved, don't try to parse IIF and OIF */
-	if (c->mfc_parent > MAXVIFS)
+	if (c->mfc_parent >= MAXVIFS)
 		return -ENOENT;
 
 	if (VIF_EXISTS(mrt, c->mfc_parent))

net/ipv6/ip6mr.c +1 -1

index bd9e7d3..073071f 100644
@@ -2017,7 +2017,7 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
 	struct rtattr *mp_head;
 
 	/* If cache is unresolved, don't try to parse IIF and OIF */
-	if (c->mf6c_parent > MAXMIFS)
+	if (c->mf6c_parent >= MAXMIFS)
 		return -ENOENT;
 
 	if (MIF_EXISTS(mrt, c->mf6c_parent))

David Miller

maintainer Applied

2010-05-26 07:39 UTC #1 lore raw

From: Dan Carpenter <[email protected]>
Date: Sat, 22 May 2010 19:54:48 +0200

Quoted 7 lines

This fixes a smatch warning:
	net/ipv4/ipmr.c +1917 __ipmr_fill_mroute(12) error: buffer overflow
	'(mrt)->vif_table' 32 <= 32
The ipv6 version had the same issue.
Signed-off-by Dan Carpenter <[email protected]>

Introduced by commit "7438189b".

Applied, thanks Dan.