The ipf module calculates fragment bounds with uint16_t, that can be wrapped around, causing access to invalid memory. Fix it. Other commits are supporting this fix.
v3-v2: - Added ipf: Drop overlap fragments. - Added ofproto-dpif: Use strip_recirc in reassembly dump-flows checks. - Zero-payload commit now focuses only on adding an additional byte to the test, as the new bounds commit would reject it otherwise. - Wrapping bounds - separated checks for rest_len <= 0. Eli Britstein (4): ipf: Drop overlap fragments. ofproto-dpif: Use strip_recirc in reassembly dump-flows checks. ofproto-dpif: Fix reassembly test for zero-payload frags. ipf: Reject IPv4/v6 fragments with wrapping bounds. lib/ipf.c | 64 ++++++++++++++++++++++------ tests/ofproto-dpif.at | 99 +++++++++++++++++++++++++++++++------------ 2 files changed, 124 insertions(+), 39 deletions(-) -- 2.43.0 _______________________________________________ dev mailing list [email protected] https://mail.openvswitch.org/mailman/listinfo/ovs-dev
