net: fix out-of-bounds write in IP fragment reassembly

__net_defragment() reassembles IP fragments into the static buffer
pkt_buff[CONFIG_NET_MAXDEFRAG].  The bounds check

	if (start + len > IP_MAXUDP)
		return NULL;

only covers the fragment data copy.  The split-hole and move-hole
branches additionally write an 8-byte struct hole via "*newh = *h" at
newh = thisfrag + len / 8, which can land up to sizeof(struct hole)
bytes past the end of pkt_buff.  A single fragment with a non-zero
fragment offset and the More-Fragments flag set reaches this path, so
a crafted fragment received during netboot overflows the buffer.

Reject any fragment whose trailing hole descriptor would fall outside
pkt_buff.

Signed-off-by: Shahriyar Jalayeri <[email protected]>
Acked-by: Jerome Forissier <[email protected]>

0 files changed, 0 insertions, 0 deletions