[PATCH] Trivial fix for out of bounds array access in xfrm4_policy_check

[PATCH] Trivial fix for out of bounds array access in xfrm4_policy_check

[Catalin(ux aka Dino) BOIE]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 620 bytes --]

Hello!

Coverity found a bug in accessing xfrm4_policy_check using XFRM_POLICY_FWD 
(=2) as index in sk->sk_policy.

sk->sk_policy[] is defined in sock.h as:

struct xfrm_policy *sk_policy[2];

Attached is the fix.

http://linuxbugs.coverity.com/external/editbugparent.php?viewbugid=2138&checkers%5B%5D=all&status%5B%5D=BUG&status%5B%5D=UNINSPECTED&status%5B%5D=UNKNOWN&status%5B%5D=DON%27T%20CARE&status%5B%5D=PENDING&product%5B%5D=all&component%5B%5D=all&file=&fn=&sortby=reverse_rank&before=&after=&curpage=2&bugid=-1&comment=&reason=

---
Catalin(ux aka Dino) BOIE
catab at deuroconsult.ro
http://kernel.umbrella.ro/

[-- Attachment #2: Type: TEXT/PLAIN, Size: 433 bytes --]

--- linux/include/net/sock.h	2004-09-07 13:13:31.000000000 +0300
+++ mylinux/include/net/sock.h	2004-09-07 13:14:36.000000000 +0300
@@ -201,7 +201,7 @@ struct sock {
 	wait_queue_head_t	*sk_sleep;
 	struct dst_entry	*sk_dst_cache;
 	rwlock_t		sk_dst_lock;
-	struct xfrm_policy	*sk_policy[2];
+	struct xfrm_policy	*sk_policy[3];
 	atomic_t		sk_rmem_alloc;
 	struct sk_buff_head	sk_receive_queue;
 	atomic_t		sk_wmem_alloc;

Re: [PATCH] Trivial fix for out of bounds array access in xfrm4_policy_check

[Herbert Xu]

Catalinux aka Dino BOIE <util@deuroconsult.ro> wrote:
> 
> Coverity found a bug in accessing xfrm4_policy_check using XFRM_POLICY_FWD 
> (=2) as index in sk->sk_policy.
> 
> sk->sk_policy[] is defined in sock.h as:
> 
> struct xfrm_policy *sk_policy[2];
> 
> Attached is the fix.

This is bogus as if the packet is forwarded then sk == NULL.
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH] Trivial fix for out of bounds array access in xfrm4_policy_check

[David S. Miller]

On Tue, 07 Sep 2004 22:46:22 +1000
Herbert Xu <herbert@gondor.apana.org.au> wrote:

> Catalinux aka Dino BOIE <util@deuroconsult.ro> wrote:
> > 
> > Coverity found a bug in accessing xfrm4_policy_check using XFRM_POLICY_FWD 
> > (=2) as index in sk->sk_policy.
> > 
> > sk->sk_policy[] is defined in sock.h as:
> > 
> > struct xfrm_policy *sk_policy[2];
> > 
> > Attached is the fix.
> 
> This is bogus as if the packet is forwarded then sk == NULL.

Agreed.