[ovs-dev] [PATCH] conntrack: force packet length check in extract_l3_ipv4

Li RongQing lirongqing at baidu.com
Wed Feb 13 09:09:13 UTC 2019


Assure the packet size is larger than ip total length

Signed-off-by: Li RongQing <lirongqing at baidu.com>
---
 lib/conntrack.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/conntrack.c b/lib/conntrack.c
index 5c43410ec..4a39327b3 100644
--- a/lib/conntrack.c
+++ b/lib/conntrack.c
@@ -1525,6 +1525,10 @@ extract_l3_ipv4(struct conn_key *key, const void *data, size_t size,
         return false;
     }
 
+    if (OVS_UNLIKELY(size < ntohs(ip->ip_tot_len))) {
+        return false;
+    }
+
     if (IP_IS_FRAGMENT(ip->ip_frag_off)) {
         return false;
     }
-- 
2.16.2



More information about the dev mailing list