git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 29e1fa3565a7951cc415c634eb2b78dbdbee151d Mon Sep 17 00:00:00 2001
   2 From: Ang Way Chuang <wcang79@gmail.com>
   3 Date: Thu, 25 Feb 2010 09:45:03 +0800
   4 Subject: dvb-core: Fix DoS bug in ULE decapsulation code that can be triggered by an invalid Payload Pointer
   5
   6 From: Ang Way Chuang <wcang79@gmail.com>
   7
   8 commit 29e1fa3565a7951cc415c634eb2b78dbdbee151d upstream.
   9
  10 ULE (Unidirectional Lightweight Encapsulation RFC 4326) decapsulation
  11 has a bug that causes endless loop when Payload Pointer of MPEG2-TS
  12 frame is 182 or 183.  Anyone who sends malicious MPEG2-TS frame will
  13 cause the receiver of ULE SNDU to go into endless loop.
  14
  15 This patch was generated and tested against linux-2.6.32.9 and should
  16 apply cleanly to linux-2.6.33 as well because there was only one typo
  17 fix to dvb_net.c since v2.6.32.
  18
  19 This bug was brought to you by modern day Santa Claus who decided to
  20 shower the satellite dish at Keio University with heavy snow causing
  21 huge burst of errors.  We, receiver end, received Santa Claus's gift in
  22 the form of kernel bug.
  23
  24 Care has been taken not to introduce more bug by fixing this bug, but
  25 please scrutinize the code for I always produces buggy code.
  26
  27 Signed-off-by: Ang Way Chuang <wcang79@gmail.com>
  28 Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
  29 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  30 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  31
  32 ---
  33  drivers/media/dvb/dvb-core/dvb_net.c |    1 +
  34  1 file changed, 1 insertion(+)
  35
  36 --- a/drivers/media/dvb/dvb-core/dvb_net.c
  37 +++ b/drivers/media/dvb/dvb-core/dvb_net.c
  38 @@ -504,6 +504,7 @@ static void dvb_net_ule( struct net_devi
  39                                        "bytes left in TS.  Resyncing.\n", ts_remain);
  40                                 priv->ule_sndu_len = 0;
  41                                 priv->need_pusi = 1;
  42 +                               ts += TS_SZ;
  43                                 continue;
  44                         }
  45