diff options
| author | YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org> | 2013-01-18 02:05:03 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-01-18 14:41:13 -0500 |
| commit | 115b0aa6b444e8dd89b7f67b77b8c472763fbc1a (patch) | |
| tree | d242f8dcb91fcaceb14011874c5d6a5f74f7e0de /net/ipv6/ndisc.c | |
| parent | 12fd84f4383b15b0a12cfd50b7c527cd55d6f101 (diff) | |
ndisc: Check NS message length before access.
Check message length before accessing "target" field,
as we do for other types.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6/ndisc.c')
| -rw-r--r-- | net/ipv6/ndisc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 429622d74705..350f86005c13 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -671,6 +671,11 @@ static void ndisc_recv_ns(struct sk_buff *skb) bool inc; int is_router = -1; + if (skb->len < sizeof(struct nd_msg)) { + ND_PRINTK(2, warn, "NS: packet too short\n"); + return; + } + if (ipv6_addr_is_multicast(&msg->target)) { ND_PRINTK(2, warn, "NS: multicast target address\n"); return; |