RIOT-OS/RIOT
RIOT-OS/RIOT
1
0
Fork 0
mirror of https://github.com/RIOT-OS/RIOT.git synced 2024-12-29 04:50:03 +01:00
Code Releases Activity

gnrc_sixlowpan_frag_rb: fix OOB write in _rbuf_add

Browse Source
This commit is contained in:
Martine Lenders 2023-05-30 14:39:00 +02:00
parent e690ef4c12
commit 1aeb90ee55
No known key found for this signature in database
GPG Key ID: 2134D77A5336DD80
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
sys/net/gnrc/network_layer/sixlowpan/frag/rb/gnrc_sixlowpan_frag_rb.c
View File

@ -461,6 +461,19 @@ static int _rbuf_add(gnrc_netif_hdr_t *netif_hdr, gnrc_pktsnip_t *pkt,
else if (IS_USED(MODULE_GNRC_SIXLOWPAN_FRAG_SFR) &&
sixlowpan_sfr_rfrag_is(pkt->data)) {
entry.super->datagram_size--;
/* Check, if fragment is still small enough to fit datagram size.
* `offset` is 0, as this is the first fragment so it does not have to be added
* here. */
if (frag_size > entry.super->datagram_size) {
DEBUG_PUTS(
"6lo rfrag: fragment too big for resulting datagram, "
"discarding datagram\n"
);
gnrc_pktbuf_release(entry.rbuf->pkt);
gnrc_pktbuf_release(pkt);
gnrc_sixlowpan_frag_rb_remove(entry.rbuf);
return RBUF_ADD_ERROR;
}
}
}
}