1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
From: Miroslav Lichvar <mlichvar@redhat.com>
Date: Fri, 26 Mar 2021 09:57:43 +0100
Subject: tc: Fix length of follow-up message of one-step sync.
Origin: https://github.com/richardcochran/linuxptp/commit/0b3ab45de6a96ca181a5cf62c3c2b97167e2ed20
Bug-Debian: https://bugs.debian.org/990749
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2021-3571
Convert the length of the generated follow-up message to network order.
This fixes reading and sending of data past the message buffer.
Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
---
tc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tc.c b/tc.c
index fb466031a7ca..0346ba969e17 100644
--- a/tc.c
+++ b/tc.c
@@ -452,7 +452,7 @@ int tc_fwd_sync(struct port *q, struct ptp_message *msg)
}
fup->header.tsmt = FOLLOW_UP | (msg->header.tsmt & 0xf0);
fup->header.ver = msg->header.ver;
- fup->header.messageLength = sizeof(struct follow_up_msg);
+ fup->header.messageLength = htons(sizeof(struct follow_up_msg));
fup->header.domainNumber = msg->header.domainNumber;
fup->header.sourcePortIdentity = msg->header.sourcePortIdentity;
fup->header.sequenceId = msg->header.sequenceId;
--
2.32.0
|
