From: Miroslav Lichvar Date: Fri, 26 Mar 2021 09:57:43 +0100 Subject: tc: Fix length of follow-up message of one-step sync. Origin: https://github.com/richardcochran/linuxptp/commit/0b3ab45de6a96ca181a5cf62c3c2b97167e2ed20 Bug-Debian: https://bugs.debian.org/990749 Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-3571 Convert the length of the generated follow-up message to network order. This fixes reading and sending of data past the message buffer. Signed-off-by: Miroslav Lichvar --- tc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tc.c b/tc.c index fb466031a7ca..0346ba969e17 100644 --- a/tc.c +++ b/tc.c @@ -452,7 +452,7 @@ int tc_fwd_sync(struct port *q, struct ptp_message *msg) } fup->header.tsmt = FOLLOW_UP | (msg->header.tsmt & 0xf0); fup->header.ver = msg->header.ver; - fup->header.messageLength = sizeof(struct follow_up_msg); + fup->header.messageLength = htons(sizeof(struct follow_up_msg)); fup->header.domainNumber = msg->header.domainNumber; fup->header.sourcePortIdentity = msg->header.sourcePortIdentity; fup->header.sequenceId = msg->header.sequenceId; -- 2.32.0