| Message ID | 50F93A6F.9020303@linux-ipv6.org |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Date: Fri, 18 Jan 2013 21:05:03 +0900 > Check message length before accessing "target" field, > as we do for other types. > > Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Applied. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 429622d..350f860 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -671,6 +671,11 @@ static void ndisc_recv_ns(struct sk_buff *skb) bool inc; int is_router = -1; + if (skb->len < sizeof(struct nd_msg)) { + ND_PRINTK(2, warn, "NS: packet too short\n"); + return; + } + if (ipv6_addr_is_multicast(&msg->target)) { ND_PRINTK(2, warn, "NS: multicast target address\n"); return;
Check message length before accessing "target" field, as we do for other types. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> --- net/ipv6/ndisc.c | 5 +++++ 1 file changed, 5 insertions(+)