RE: [PATCH] tipc: validate data size before reading Gap ACK block header

[Tung Quang Nguyen]

>Subject: [PATCH] tipc: validate data size before reading Gap ACK block header
>
>tipc_get_gap_ack_blks() reads the Gap ACK block header fields (len, ugack_cnt,
>bgack_cnt) from msg_data(hdr) without first checking that the message data
>area is large enough to hold the header struct.  A peer that has negotiated
>TIPC_GAP_ACK_BLOCK capability can send a STATE_MSG or broadcast
>PROTOCOL message with a data area shorter than sizeof(struct
>tipc_gap_ack_blks), causing an out-of-bounds read of up to 4 bytes past the
>valid skb data.
This cannot happen. Please send me your reproducer.
Note that it is not recommended  to create fake TIPC protocol messages via UDP bearer in insecure environment.
In such insecure environment, IPSec must be used: https://datatracker.ietf.org/doc/html/draft-maloy-tipc-01.txt#section-6