On Sun, 31 Aug 2025 16:56:23 +0200, Stanislav Fort wrote:
> batadv_nc_skb_decode_packet() trusts coded_len and checks only against
> skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing
> payload headroom, and the source skb length is not verified, allowing an
> out-of-bounds read and a small out-of-bounds write.
>
> Validate that coded_len fits within the payload area of both destination
> and source sk_buffs before XORing.
>
> [...]
Applied, thanks!
[1/1] batman-adv: fix OOB read/write in network-coding decode
https://git.open-mesh.org/linux-merge.git/commit/?h=batadv/net&id=d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087
Best regards,
--
Sven Eckelmann <[email protected]>
