The ipf module calculates fragment bounds with uint16_t, that can be wrapped around, causing access to invalid memory. Fix it. Other commits are supporting this fix.
v3-v2: - Added ipf: Drop overlap fragments. - Added ofproto-dpif: Use strip_recirc in reassembly dump-flows checks. - Zero-payload commit now focuses only on adding an additional byte to the test, as the new bounds commit would reject it otherwise. - Wrapping bounds - separated checks for rest_len <= 0. -v4-v3: - Added 2 more commits. - Wrapping bounds - added a TOO_LARGE counter. Eli Britstein (4): ipf: Drop overlap fragments. ofproto-dpif: Use strip_recirc in reassembly dump-flows checks. ofproto-dpif: Fix reassembly test for zero-payload frags. ipf: Reject IPv4/v6 fragments with wrapping bounds. ipf: Detect fully containing overlapping fragments. ipf: Reject fragments beyond the last fragment. lib/dpctl.c | 4 + lib/dpif-provider.h | 1 + lib/ipf.c | 129 ++++++++++++---- lib/ipf.h | 1 + tests/ofproto-dpif.at | 246 +++++++++++++++++++++++++++---- tests/system-userspace-macros.at | 8 + 6 files changed, 338 insertions(+), 51 deletions(-) -- 2.43.0 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
