summaryrefslogtreecommitdiffstats
path: root/net/ipv6/ndisc.c
diff options
context:
space:
mode:
authorYOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org>2013-01-18 02:05:03 +0000
committerDavid S. Miller <davem@davemloft.net>2013-01-18 14:41:13 -0500
commit115b0aa6b444e8dd89b7f67b77b8c472763fbc1a (patch)
treed242f8dcb91fcaceb14011874c5d6a5f74f7e0de /net/ipv6/ndisc.c
parent12fd84f4383b15b0a12cfd50b7c527cd55d6f101 (diff)
downloadop-kernel-dev-115b0aa6b444e8dd89b7f67b77b8c472763fbc1a.zip
op-kernel-dev-115b0aa6b444e8dd89b7f67b77b8c472763fbc1a.tar.gz
ndisc: Check NS message length before access.
Check message length before accessing "target" field, as we do for other types. Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/ndisc.c')
-rw-r--r--net/ipv6/ndisc.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 429622d..350f860 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -671,6 +671,11 @@ static void ndisc_recv_ns(struct sk_buff *skb)
bool inc;
int is_router = -1;
+ if (skb->len < sizeof(struct nd_msg)) {
+ ND_PRINTK(2, warn, "NS: packet too short\n");
+ return;
+ }
+
if (ipv6_addr_is_multicast(&msg->target)) {
ND_PRINTK(2, warn, "NS: multicast target address\n");
return;
OpenPOWER on IntegriCloud