I've heard some bad things about a box killing exploit that
relies on a kernel buffer overrun in ip_fraqment.c, and that
the appended patch is in 2.0.32-pre4.
If these nasty rumours are true, could an equivalent make it
into 2.1.65?
Cheers,
Matthew.
--- linux/net/ipv4/ip_fragment.c~ Tue Jul 15 16:35:10 1997
+++ linux/net/ipv4/ip_fragment.c Fri Nov 14 09:37:35 1997
@@ -582,7 +582,9 @@
*/
tfp = NULL;
- tfp = ip_frag_create(offset, end, skb, ptr);
+
+ if(offset<end)
+ tfp = ip_frag_create(offset, end, skb, ptr);
/*
* No memory to save the fragment - so throw the lot. If we