Re: [ovs-dev] [PATCH ovn] pinctrl: Fix buffer overread in pinctrl_compose_ipv6().

2020-02-27 Thread Numan Siddique
On Tue, Feb 25, 2020 at 3:02 PM Numan Siddique wrote: > > On Tue, Feb 25, 2020 at 2:43 PM Dumitru Ceara wrote: > > > > On 2/25/20 12:39 AM, Ben Pfaff wrote: > > > The call to packet_set_ipv6() calls into packet_rh_present(), which in > > > turn iterates through the L3 content. Without this

Re: [ovs-dev] [PATCH ovn] pinctrl: Fix buffer overread in pinctrl_compose_ipv6().

2020-02-25 Thread Numan Siddique
On Tue, Feb 25, 2020 at 2:43 PM Dumitru Ceara wrote: > > On 2/25/20 12:39 AM, Ben Pfaff wrote: > > The call to packet_set_ipv6() calls into packet_rh_present(), which in > > turn iterates through the L3 content. Without this commit, the l4_ofs > > in the packet has its default value of

Re: [ovs-dev] [PATCH ovn] pinctrl: Fix buffer overread in pinctrl_compose_ipv6().

2020-02-25 Thread Dumitru Ceara
On 2/25/20 12:39 AM, Ben Pfaff wrote: > The call to packet_set_ipv6() calls into packet_rh_present(), which in > turn iterates through the L3 content. Without this commit, the l4_ofs > in the packet has its default value of UINT16_MAX, which means that > packet_rh_present() reads well beyond the

[ovs-dev] [PATCH ovn] pinctrl: Fix buffer overread in pinctrl_compose_ipv6().

2020-02-24 Thread Ben Pfaff
The call to packet_set_ipv6() calls into packet_rh_present(), which in turn iterates through the L3 content. Without this commit, the l4_ofs in the packet has its default value of UINT16_MAX, which means that packet_rh_present() reads well beyond the real maximum length of the IPv6 header.