Stefan Richter 667121ace9 firewire: net: guard against rx buffer overflows ... The IP-over-1394 driver firewire-net lacked input validation when handling incoming fragmented datagrams. A maliciously formed fragment with a respectively large datagram_offset would cause a memcpy past the datagram buffer. So, drop any packets carrying a fragment with offset + length larger than datagram_size. In addition, ensure that - GASP header, unfragmented encapsulation header, or fragment encapsulation header actually exists before we access it, - the encapsulated datagram or fragment is of nonzero size. Reported-by: Eyal Itkin <eyal.itkin@gmail.com> Reviewed-by: Eyal Itkin <eyal.itkin@gmail.com> Fixes: CVE 2016-8633 Cc: stable@vger.kernel.org Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>		2016-11-03 14:46:39 +01:00
..
core-card.c
core-cdev.c	firewire: use in_compat_syscall to check ioctl compatness	2016-03-22 15:36:02 -07:00
core-device.c
core-iso.c
core-topology.c
core-transaction.c
core.h
init_ohci1394_dma.c
Kconfig
Makefile
net.c	firewire: net: guard against rx buffer overflows	2016-11-03 14:46:39 +01:00
nosy-user.h
nosy.c	firewire: nosy: do not ignore errors in ioremap_nocache()	2016-10-09 11:38:11 +02:00
nosy.h
ohci.c
ohci.h
sbp2.c