aboutgitcodebugslistschat
diff options
context:
space:
mode:
authorDavid Gibson <david@gibson.dropbear.id.au>2022-09-24 19:08:23 +1000
committerStefano Brivio <sbrivio@redhat.com>2022-09-24 14:48:35 +0200
commit8978f6552b8cfae28b9d842db99b01aefb465812 (patch)
tree05ec8c3d3959f3d5e0adafbd71c0ac051e911675
parentd5b80ccc72ed36367ac327748be66323c858ad5d (diff)
downloadpasst-8978f6552b8cfae28b9d842db99b01aefb465812.tar
passt-8978f6552b8cfae28b9d842db99b01aefb465812.tar.gz
passt-8978f6552b8cfae28b9d842db99b01aefb465812.tar.bz2
passt-8978f6552b8cfae28b9d842db99b01aefb465812.tar.lz
passt-8978f6552b8cfae28b9d842db99b01aefb465812.tar.xz
passt-8978f6552b8cfae28b9d842db99b01aefb465812.tar.zst
passt-8978f6552b8cfae28b9d842db99b01aefb465812.zip
icmp: Correct off by one errors dealing with number of echo request ids2022_09_24.8978f65
ICMP echo request and reply packets include a 16-bit 'id' value. We have some arrays indexed by this id value. Unfortunately we size those arrays with USHRT_MAX (65535) when they need to be sized by the total number of id values (65536). This could lead to buffer overruns. Resize the arrays correctly, using a new define for the purpose. Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
-rw-r--r--icmp.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/icmp.c b/icmp.c
index 2da8b58..39a8694 100644
--- a/icmp.c
+++ b/icmp.c
@@ -39,6 +39,7 @@
#include "icmp.h"
#define ICMP_ECHO_TIMEOUT 60 /* s, timeout for ICMP socket activity */
+#define ICMP_NUM_IDS (1U << 16)
/**
* struct icmp_id_sock - Tracking information for single ICMP echo identifier
@@ -53,10 +54,10 @@ struct icmp_id_sock {
};
/* Indexed by ICMP echo identifier */
-static struct icmp_id_sock icmp_id_map [IP_VERSIONS][USHRT_MAX];
+static struct icmp_id_sock icmp_id_map[IP_VERSIONS][ICMP_NUM_IDS];
/* Bitmaps, activity monitoring needed for identifier */
-static uint8_t icmp_act [IP_VERSIONS][USHRT_MAX / 8];
+static uint8_t icmp_act[IP_VERSIONS][DIV_ROUND_UP(ICMP_NUM_IDS, 8)];
/**
* icmp_sock_handler() - Handle new data from socket