>From 8088f4bd266169ee3c004ca73d691f6dbd3242c2 Mon Sep 17 00:00:00 2001 From: FUJITA Tomonori Date: Wed, 16 Jun 2010 11:53:08 +0900 Subject: [PATCH] iscsi: fix the handling of bogus tlv->length Signed-off-by: FUJITA Tomonori --- usr/iscsi/isns.c | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-) diff --git a/usr/iscsi/isns.c b/usr/iscsi/isns.c index a0f7fcb..a61c72f 100644 --- a/usr/iscsi/isns.c +++ b/usr/iscsi/isns.c @@ -611,6 +611,9 @@ static char *print_scn_pdu(struct isns_hdr *hdr) while (length) { uint32_t vlen = ntohl(tlv->length); + if (vlen + sizeof(*tlv) > length) + vlen = length - sizeof(*tlv); + switch (ntohl(tlv->tag)) { case ISNS_ATTR_ISCSI_NAME: eprintf("scn name: %u, %s\n", vlen, (char *) tlv->value); @@ -678,11 +681,17 @@ found: /* skip status */ tlv = (struct isns_tlv *) ((char *) hdr->pdu + 4); + + if (length < 4) + goto free_qry_mgmt; length -= 4; while (length) { uint32_t vlen = ntohl(tlv->length); + if (vlen + sizeof(*tlv) > length) + vlen = length - sizeof(*tlv); + switch (ntohl(tlv->tag)) { case ISNS_ATTR_ISCSI_NAME: name = (char *) tlv->value; -- 1.6.5