diff options
| author | YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> | 2006-04-18 23:46:26 +0200 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-04-19 00:57:50 +0200 |
| commit | ec6700958a776a83681ecb11239c0525730c42ba (patch) | |
| tree | 07e6953adb8dab01b9e6c7415c886c124cefa541 | |
| parent | [TCP]: Fix truesize underflow (diff) | |
| download | linux-ec6700958a776a83681ecb11239c0525730c42ba.tar.xz linux-ec6700958a776a83681ecb11239c0525730c42ba.zip | |
[IPV6]: Ensure to have hop-by-hop options in our header of &sk_buff.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv6/exthdrs.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c index 2a1e7e45b890..d88cab7b973f 100644 --- a/net/ipv6/exthdrs.c +++ b/net/ipv6/exthdrs.c @@ -489,6 +489,18 @@ int ipv6_parse_hopopts(struct sk_buff *skb, int nhoff) { struct inet6_skb_parm *opt = IP6CB(skb); + /* + * skb->nh.raw is equal to skb->data, and + * skb->h.raw - skb->nh.raw is always equal to + * sizeof(struct ipv6hdr) by definition of + * hop-by-hop options. + */ + if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) || + !pskb_may_pull(skb, sizeof(struct ipv6hdr) + ((skb->h.raw[1] + 1) << 3))) { + kfree_skb(skb); + return -1; + } + opt->hop = sizeof(struct ipv6hdr); if (ip6_parse_tlv(tlvprochopopt_lst, skb)) { skb->h.raw += (skb->h.raw[1]+1)<<3; |