RE: [PATCH] tipc: validate data size before reading Gap ACK block header

Subject: [PATCH] tipc: validate data size before reading Gap ACK block header

tipc_get_gap_ack_blks() reads the Gap ACK block header fields (len, ugack_cnt,
bgack_cnt) from msg_data(hdr) without first checking that the message data
area is large enough to hold the header struct.  A peer that has negotiated
TIPC_GAP_ACK_BLOCK capability can send a STATE_MSG or broadcast
PROTOCOL message with a data area shorter than sizeof(struct
tipc_gap_ack_blks), causing an out-of-bounds read of up to 4 bytes past the
valid skb data.

This cannot happen. Please send me your reproducer.
Note that it is not recommended  to create fake TIPC protocol messages via UDP bearer in insecure environment.
In such insecure environment, IPSec must be used: https://datatracker.ietf.org/doc/html/draft-maloy-tipc-01.txt#section-6