diff options
| author | Sabrina Dubroca <sd@queasysnail.net> | 2017-07-19 22:28:55 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-07-20 07:50:14 +0200 |
| commit | 6399f1fae4ec29fab5ec76070435555e256ca3a6 (patch) | |
| tree | 3bf30f18bbd1c9eb4b37786cba7fe73e70ea014b /include | |
| parent | net: tehuti: don't process data if it has not been copied from userspace (diff) | |
| download | linux-6399f1fae4ec29fab5ec76070435555e256ca3a6.tar.xz linux-6399f1fae4ec29fab5ec76070435555e256ca3a6.zip | |
ipv6: avoid overflow of offset in ip6_find_1stfragopt
In some cases, offset can overflow and can cause an infinite loop in
ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.
This problem has been here since before the beginning of git history.
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions