Bugtraq: Re: Big problem on linux 2.0

[andrea () SUSE DE (Andrea Arcangeli)]

On Sat, 11 Dec 1999, visi0n wrote:

>       In my last mail I'd posted a patch for kernel 2.0.38, that  was
> made against a modified socket.c you need this one for the original kernel
> (2.0.38). Sorry...
>
> @@ -966,8 +966,9 @@
>        struct msghdr msg;
>        struct iovec iov;
>
> -       if(len<0)
> +       if(len < 0 || len >= 65468)
>                return -EINVAL;
> +
>        err=verify_area(VERIFY_READ,buff,len);
>        if(err)
>                return err;
The above patch doesn't fix the bug, because you can still use
the other kernel entry points send/sendmsg to feed a big payload
ip_build_xmit.

Also note that you don't need to restrict to 65467 bytes the max size of a
packet when the ip options are < 40 bytes.

Andrea