[commits] [batman-adv] maint: batman-adv: Fix invalid read while copying bat_iv.bcast_own (cee1039)

postmaster at open-mesh.org postmaster at open-mesh.org
Wed Dec 30 12:38:12 CET 2015


Repository : ssh://git@open-mesh.org/batman-adv

On branch  : maint

>---------------------------------------------------------------

commit cee103946bb05db00e351cf8b5dee9c8aed8d5f8
Author: Sven Eckelmann <sven at narfation.org>
Date:   Sun Nov 29 01:48:57 2015 +0100

    batman-adv: Fix invalid read while copying bat_iv.bcast_own
    
    batadv_iv_ogm_orig_del_if removes a part of the bcast_own which previously
    belonged to the now removed interface. This is done by copying all data
    which comes before the removed interface and then appending all the data
    which comes after the removed interface.
    
    The address calculation for the position of the data which comes after the
    removed interface assumed that the bat_iv.bcast_own is a pointer to a
    single byte datatype. But it is a pointer to unsigned long and thus the
    calculated position was wrong off factor sizeof(unsigned long).
    
    Fixes: 83a8342678a0 ("more basic routing code added (forwarding packets /
    bitarray added)")
    
    Signed-off-by: Sven Eckelmann <sven at narfation.org>
    Signed-off-by: Marek Lindner <mareklindner at neomailbox.ch>


>---------------------------------------------------------------

cee103946bb05db00e351cf8b5dee9c8aed8d5f8
 net/batman-adv/bat_iv_ogm.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index 912d9c3..aa94b4e 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -185,7 +185,8 @@ unlock:
 static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node,
 				     int max_if_num, int del_if_num)
 {
-	int chunk_size,  ret = -ENOMEM, if_offset;
+	int ret = -ENOMEM;
+	size_t chunk_size, if_offset;
 	void *data_ptr = NULL;
 
 	spin_lock_bh(&orig_node->bat_iv.ogm_cnt_lock);
@@ -203,8 +204,9 @@ static int batadv_iv_ogm_orig_del_if(struct batadv_orig_node *orig_node,
 	memcpy(data_ptr, orig_node->bat_iv.bcast_own, del_if_num * chunk_size);
 
 	/* copy second part */
+	if_offset = (del_if_num + 1) * chunk_size;
 	memcpy((char *)data_ptr + del_if_num * chunk_size,
-	       orig_node->bat_iv.bcast_own + ((del_if_num + 1) * chunk_size),
+	       (uint8_t *)orig_node->bat_iv.bcast_own + if_offset,
 	       (max_if_num - del_if_num) * chunk_size);
 
 free_bcast_own:



More information about the commits mailing list