Commit aca701c6 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'batadv-net-pullrequest-20250901' of https://git.open-mesh.org/linux-merge 

Simon Wunderlich says:

====================
Here is a batman-adv bugfix:

 - fix OOB read/write in network-coding decode, by Stanislav Fort

* tag 'batadv-net-pullrequest-20250901' of https://git.open-mesh.org/linux-merge:
  batman-adv: fix OOB read/write in network-coding decode
====================

Link: https://patch.msgid.link/


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 030e1c45 d77b6ff0

net/batman-adv/network-coding.c

+6 −1
Original line number Diff line number Diff line
@@ -1687,7 +1687,12 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb, 


	coding_len = ntohs(coded_packet_tmp.coded_len);



	if (coding_len > skb->len)

	/* ensure dst buffer is large enough (payload only) */

	if (coding_len + h_size > skb->len)

		return NULL;



	/* ensure src buffer is large enough (payload only) */

	if (coding_len + h_size > nc_packet->skb->len)

		return NULL;



	/* Here the magic is reversed: