]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
batman-adv: fix integer overflow on buff_pos
authorLyes Bourennani <lbourennani@fuzzinglabs.com>
Tue, 21 Apr 2026 22:20:22 +0000 (00:20 +0200)
committerSven Eckelmann <sven@narfation.org>
Sat, 2 May 2026 19:58:27 +0000 (21:58 +0200)
commit0799e5943611006b346b8813c7daf7dd5aa26bfd
tree2c8f90ba922babc0ee54b9ef5a1eb09996e2ce9b
parent1f5ffc672165ff851063a5fd044b727ab2517ae3
batman-adv: fix integer overflow on buff_pos

Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size
check is done using the int type in batadv_iv_ogm_aggr_packet whereas the
buff_pos variable uses the s16 type. This could lead to an out-of-bound
read.

Cc: stable@vger.kernel.org
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Signed-off-by: Lyes Bourennani <lbourennani@fuzzinglabs.com>
Signed-off-by: Alexis Pinson <apinson@fuzzinglabs.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
net/batman-adv/bat_iv_ogm.c