diff options
| author | David Gibson <david@gibson.dropbear.id.au> | 2024-02-20 13:48:24 +1100 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2024-02-20 08:14:28 +0100 |
| commit | 1e6f92b995a9f7bff83b8b7a4b51782804fc23c5 (patch) | |
| tree | 297c06c76fea753d224c18606c2af3e84c32b5fb /tcp_splice.c | |
| parent | 8954c4a91b98b734797c3d1292d6635d917fa4d8 (diff) | |
| download | passt-1e6f92b995a9f7bff83b8b7a4b51782804fc23c5.tar passt-1e6f92b995a9f7bff83b8b7a4b51782804fc23c5.tar.gz passt-1e6f92b995a9f7bff83b8b7a4b51782804fc23c5.tar.bz2 passt-1e6f92b995a9f7bff83b8b7a4b51782804fc23c5.tar.lz passt-1e6f92b995a9f7bff83b8b7a4b51782804fc23c5.tar.xz passt-1e6f92b995a9f7bff83b8b7a4b51782804fc23c5.tar.zst passt-1e6f92b995a9f7bff83b8b7a4b51782804fc23c5.zip | |
udp: Fix 16-bit overflow in udp_invert_portmap()2024_02_20.1e6f92b
The code in udp_invert_portmap() is written based on an incorrect
understanding of C's (arcane) integer promotion rules. We calculate
'(in_port_t)i + delta' expecting the result to be of type in_port_t (16
bits). However "small integer types" (those narrower than 'int') are
always promoted to int for expressions, meaning this calculation can
overrun the rdelta[] array.
Fix this, and use a new intermediate for the index, to make it very clear
what it's type is. We also change i to unsigned, to avoid any possible
confusion from mixing signed and unsigned types.
Link: https://bugs.passt.top/show_bug.cgi?id=80
Reported-by: Laurent Jacquot <jk@lutty.net>
Suggested-by: Laurent Jacquot <jk@lutty.net>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'tcp_splice.c')
0 files changed, 0 insertions, 0 deletions