diff options
| author | J. Bruce Fields <bfields@citi.umich.edu> | 2009-08-21 17:27:29 +0200 |
|---|---|---|
| committer | J. Bruce Fields <bfields@citi.umich.edu> | 2009-08-21 17:27:29 +0200 |
| commit | e9dc122166b8d863d3057a66ada04838e5548e52 (patch) | |
| tree | 749e15bf719b64bf9113db7acd8e043d9742cb26 /net/ipv6/xfrm6_policy.c | |
| parent | sunrpc: fix memory leak in unix_gid cache. (diff) | |
| parent | SUNRPC: Ensure that sunrpc gets initialised before nfs, lockd, etc... (diff) | |
| download | linux-e9dc122166b8d863d3057a66ada04838e5548e52.tar.xz linux-e9dc122166b8d863d3057a66ada04838e5548e52.zip | |
Merge branch 'nfs-for-2.6.32' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6 into for-2.6.32-incoming
Conflicts:
net/sunrpc/cache.c
Diffstat (limited to 'net/ipv6/xfrm6_policy.c')
| -rw-r--r-- | net/ipv6/xfrm6_policy.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c index b4b16a43f277..3a3c677bc0f2 100644 --- a/net/ipv6/xfrm6_policy.c +++ b/net/ipv6/xfrm6_policy.c @@ -157,7 +157,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr); ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr); - while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) { + while (nh + offset + 1 < skb->data || + pskb_may_pull(skb, nh + offset + 1 - skb->data)) { nh = skb_network_header(skb); exthdr = (struct ipv6_opt_hdr *)(nh + offset); @@ -177,7 +178,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) case IPPROTO_TCP: case IPPROTO_SCTP: case IPPROTO_DCCP: - if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) { + if (!onlyproto && (nh + offset + 4 < skb->data || + pskb_may_pull(skb, nh + offset + 4 - skb->data))) { __be16 *ports = (__be16 *)exthdr; fl->fl_ip_sport = ports[!!reverse]; |