openwrt-mirror/routing
1
0
Fork 0
mirror of https://github.com/openwrt/routing.git synced 2025-12-21 17:04:33 +04:00
Code Issues Packages Projects Releases Wiki Activity

batman-adv: Merge bugfixes from 2025.3

Browse Source 
* fix OOB read/write in network-coding decode

Signed-off-by: Sven Eckelmann <sven@narfation.org>
This commit is contained in:
Sven Eckelmann
2025-09-05 16:19:21 +02:00
parent 2837fc66f7
commit 5a23f88425
2 changed files with 35 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
batman-adv/Makefile
View File

@@ -4,7 +4,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=batman-adv
PKG_VERSION:=2024.3
PKG_RELEASE:=6
PKG_RELEASE:=7
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=https://downloads.open-mesh.org/batman/releases/batman-adv-$(PKG_VERSION)

34
batman-adv/patches/0011-batman-adv-fix-OOB-read-write-in-network-coding-deco.patch Normal file
View File

@@ -0,0 +1,34 @@
From: Stanislav Fort <stanislav.fort@aisle.com>
Date: Sun, 31 Aug 2025 16:56:23 +0200
Subject: batman-adv: fix OOB read/write in network-coding decode
batadv_nc_skb_decode_packet() trusts coded_len and checks only against
skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing
payload headroom, and the source skb length is not verified, allowing an
out-of-bounds read and a small out-of-bounds write.
Validate that coded_len fits within the payload area of both destination
and source sk_buffs before XORing.
Fixes: 65aa656f3be9 ("batman-adv: network coding - receive coded packets and decode them")
Reported-by: Stanislav Fort <disclosure@aisle.com>
Signed-off-by: Stanislav Fort <stanislav.fort@aisle.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Origin: upstream, https://git.open-mesh.org/batman-adv.git/commit/?id=afd409d7b189044fc9bf66e50de35cb1fc08a1ee
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -1687,7 +1687,12 @@ batadv_nc_skb_decode_packet(struct batad
coding_len = ntohs(coded_packet_tmp.coded_len);
- if (coding_len > skb->len)
+ /* ensure dst buffer is large enough (payload only) */
+ if (coding_len + h_size > skb->len)
+ return NULL;
+
+ /* ensure src buffer is large enough (payload only) */
+ if (coding_len + h_size > nc_packet->skb->len)
return NULL;
/* Here the magic is reversed: