flow: Add length check when retrieving TCP flags.
authorJesse Gross <jesse@nicira.com>
Fri, 23 Mar 2012 20:14:51 +0000 (13:14 -0700)
committerJesse Gross <jesse@nicira.com>
Fri, 23 Mar 2012 23:00:59 +0000 (16:00 -0700)
commit9c47b45a3bb56009bf2553c493d097eeadd7e5c2
tree4926853a89f2197b98e918bc31c3b2b96b4b9051
parentc1f15723c03d1ed734ed1c2d2ac85e6c8b055206
flow: Add length check when retrieving TCP flags.

When collecting TCP flags we check that the IP header indicates that
a TCP header is present but not that the packet is actually long
enough to contain the header.  This adds a check to prevent reading
off the end of the packet.

In practice, this is only likely to result in reading of bad data and
not a crash due to the presence of struct skb_shared_info at the end
of the packet.

Signed-off-by: Jesse Gross <jesse@nicira.com>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
datapath/flow.c
lib/dpif-netdev.c