Исходное сообщение
"В Linux ядре 2.6.25.13 исправлены ошибки в реализации IPv6, ..." Отправлено Аноним, 31-Июл-08 22:11
l2tp: Fix potential memory corruption in pppol2tp_recvmsg() [ Upstream commit 6b6707a50c7598a83820077393f8823ab791abf8 ] This patch fixes a potential memory corruption in pppol2tp_recvmsg(). If skb->len is bigger than the caller's buffer length, memcpy_toiovec() will go into unintialized data on the kernel heap, interpret it as an iovec and start modifying memory. The fix is to change the memcpy_toiovec() call to skb_copy_datagram_iovec() so that paged packets (rare for PPPOL2TP) are handled properly. Also check that the caller's buffer is big enough for the data and set the MSG_TRUNC flag if it is not so.

Ваше сообщение
Имя*:
EMail:	Для отправки ответов на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email). Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:	> l2tp: Fix potential memory corruption in pppol2tp_recvmsg() > [ Upstream commit 6b6707a50c7598a83820077393f8823ab791abf8 ] > This patch fixes a potential memory corruption in > pppol2tp_recvmsg(). If skb->len is bigger than the caller's buffer > length, memcpy_toiovec() will go into unintialized data on the kernel > heap, interpret it as an iovec and start modifying memory. > The fix is to change the memcpy_toiovec() call to > skb_copy_datagram_iovec() so that paged packets (rare for PPPOL2TP) > are handled properly. Also check that the caller's buffer is big > enough for the data and set the MSG_TRUNC flag if it is > not so.
	Введите код, изображенный на картинке: