Re: [PATCH net] tcp: don't read out-of-bounds opsize

From: Jann Horn Date: Fri, 20 Apr 2018 15:57:30 +0200 > The old code reads the "opsize" variable from out-of-bounds memory (first > byte behind the segment) if a broken TCP segment ends directly after an > opcode that is neither EOL nor NOP. > > The result of the read isn't used for anything, so

Re: [PATCH net] tcp: don't read out-of-bounds opsize

On 04/20/2018 06:57 AM, Jann Horn wrote: > The old code reads the "opsize" variable from out-of-bounds memory (first > byte behind the segment) if a broken TCP segment ends directly after an > opcode that is neither EOL nor NOP. > > The result of the read isn't used for anything, so the worst th

[PATCH net] tcp: don't read out-of-bounds opsize

The old code reads the "opsize" variable from out-of-bounds memory (first byte behind the segment) if a broken TCP segment ends directly after an opcode that is neither EOL nor NOP. The result of the read isn't used for anything, so the worst thing that could theoretically happen is a pagefault; a