🚀 go-pugleaf

[ Article reposted from comp.os.linux.announce ]
[ Author was Alan Cox <alan@cymru.net> ]
[ Posted on 30 Oct 1996 11:22:47 GMT ]

-----BEGIN PGP SIGNED MESSAGE-----

[ Moderator's note: I think there are newer, better versions of this
  patch available. Check the web site. --liw ]

There is a nasty bug whereby AIX, Digital Unix, Linux and possibly some
other systems can be brought down remotely by a suitably constructed
oversize packet. Unfortunately a bug in another well known PC operating
system means its easy to generate such packets.

** This bug is being actively exploited on the internet against all the
** mentioned systems. This fix should be considered essential as should
** other equivalent vendor fixes

The following Linux fix drops such faulty frames and will also be included
in 2.0.24

Alan Cox 

[Patch also available from http://www.uk.linux.org/patches/]

- --- ip_fragment.c.old   Mon Sep 16 22:14:52 1996
+++ ip_fragment.c       Sat Oct 19 01:04:47 1996
@@ -366,7 +366,7 @@
                {
                        NETDEBUG(printk("Invalid fragment list: Fragment over size.\n"));
                        ip_free(qp);
- -                       frag_kfree_skb(skb,FREE_WRITE);
+                       kfree_skb(skb,FREE_WRITE);
                        ip_statistics.IpReasmFails++;
                        return NULL;
                }
@@ -466,6 +466,18 @@
                        return NULL;
                }
        }
+
+       /*
+        *      Attempt to construct an oversize packet.
+        */
+
+       if(ntohs(iph->tot_len)+(int)offset>65535)
+       {
+               skb->sk = NULL;
+               frag_kfree_skb(skb, FREE_READ);
+               ip_statistics.IpReasmFails++;
+               return NULL;
+       }

        /*
         *      Determine the position of this fragment.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBMnc51oQRll5MupLRAQFi/QP/ct/MNsptlomq/lHyc/8bDgebcTpZ/0fJ
Slrg6rNjxoexwu2476tBIJoASAR1+BYovsywUkDw3l2fJZy64qpBbzr9W9DU243m
/iXbNWU99icA+PmJSZa5gcGdfBg4Nd3zG/d88W5RPIfp3HZTOODRp+kTGZZFBleB
Vwg5vxK0yV0=
=QPXt
-----END PGP SIGNATURE-----

-- 
This article has been digitally signed by the moderator, using PGP.
http://www.iki.fi/liw/lars-public-key.asc has PGP key for validating signature.
Send submissions for comp.os.linux.announce to: linux-announce@news.ornl.gov
PLEASE remember a short description of the software and the LOCATION.
This group is archived at http://www.iki.fi/liw/linux/cola.html



Zbigniew Zych
--
Optimus SA Oddział Kraków,     administrator,      http://onet.pl/~zych/