Re: [PATCH] arm64: bpf: fix out-of-bounds read in bpf2a64_offset()

On Thu, Jun 25, 2015 at 05:47:39AM -0700, Xi Wang wrote: > Problems occur when bpf_to or bpf_from has value prog->len - 1 (e.g., > "Very long jump backwards" in test_bpf where the last instruction is a > jump): since ctx->offset has length prog->len, ctx->offset[bpf_to + 1] > or ctx->offset[bpf_fro

Re: [PATCH] arm64: bpf: fix out-of-bounds read in bpf2a64_offset()

On 6/25/15 5:47 AM, Xi Wang wrote: Problems occur when bpf_to or bpf_from has value prog->len - 1 (e.g., "Very long jump backwards" in test_bpf where the last instruction is a jump): since ctx->offset has length prog->len, ctx->offset[bpf_to + 1] or ctx->offset[bpf_from + 1] will cause an out-of-

[PATCH] arm64: bpf: fix out-of-bounds read in bpf2a64_offset()

Problems occur when bpf_to or bpf_from has value prog->len - 1 (e.g., "Very long jump backwards" in test_bpf where the last instruction is a jump): since ctx->offset has length prog->len, ctx->offset[bpf_to + 1] or ctx->offset[bpf_from + 1] will cause an out-of-bounds read, leading to a bogus jump