evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ndisc: Check NS message length before access.

Browse source 
Check message length before accessing "target" field,
as we do for other types.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
YOSHIFUJI Hideaki / 吉藤英明 2013-01-18 02:05:03 +00:00 • committed by David S. Miller
parent 12fd84f438
commit 115b0aa6b4
1 changed files with 5 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
net/ipv6/ndisc.c
View file

@ -671,6 +671,11 @@ static void ndisc_recv_ns(struct sk_buff *skb)
bool inc; bool inc;
int is_router = -1; int is_router = -1;
if (skb->len < sizeof(struct nd_msg)) {
ND_PRINTK(2, warn, "NS: packet too short\n");
return;
}
if (ipv6_addr_is_multicast(&msg->target)) { if (ipv6_addr_is_multicast(&msg->target)) {
ND_PRINTK(2, warn, "NS: multicast target address\n"); ND_PRINTK(2, warn, "NS: multicast target address\n");
return; return;