{"push_id":673696545,"size":1,"distinct_size":1,"ref":"refs/heads/Lollipop-5.1","head":"bd64623c9d9d5346936bab02121760a8d8c71954","before":"7ec254efa299b4e853002cd9abf154d064b0c987","commits":[{"sha":"bd64623c9d9d5346936bab02121760a8d8c71954","author":{"email":"9ff04a02a69f376b2b9aeec27187017cbf3cf5f9@redhat.com","name":"Daniel Borkmann"},"message":"netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages\n\nSome occurences in the netfilter tree use skb_header_pointer() in\nthe following way ...\n\n  struct dccp_hdr _dh, *dh;\n  ...\n  skb_header_pointer(skb, dataoff, sizeof(_dh), &dh);\n\n... where dh itself is a pointer that is being passed as the copy\nbuffer. Instead, we need to use &_dh as the forth argument so that\nwe're copying the data into an actual buffer that sits on the stack.\n\nCurrently, we probably could overwrite memory on the stack (e.g.\nwith a possibly mal-formed DCCP packet), but unintentionally, as\nwe only want the buffer to be placed into _dh variable.\n\nChange-Id: Iffe16e50afdd1c3c75d927eb5aaf940efad78109\nFixes: 2bc780499aa3 (\"[NETFILTER]: nf_conntrack: add DCCP protocol support\")\nSigned-off-by: Daniel Borkmann <dborkman@redhat.com>\nSigned-off-by: Pablo Neira Ayuso <pablo@netfilter.org>","distinct":true,"url":"https://api.github.com/repos/Epirex/Samsung_STE_Kernel/commits/bd64623c9d9d5346936bab02121760a8d8c71954"}]}