diff options
| author | Wei Yongjun <yjwei@cn.fujitsu.com> | 2009-07-02 18:57:23 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2009-07-04 04:10:06 +0200 |
| commit | c615c9f3f3cea60279b1bb38e8ef27bd575ecd0c (patch) | |
| tree | 2bf343e769106a87e3cda9801e3b8cb942d722c9 /net | |
| parent | net/9p: Fix crash due to bad mount parameters. (diff) | |
| download | linux-c615c9f3f3cea60279b1bb38e8ef27bd575ecd0c.tar.xz linux-c615c9f3f3cea60279b1bb38e8ef27bd575ecd0c.zip | |
xfrm4: fix the ports decode of sctp protocol
The SCTP pushed the skb data above the sctp chunk header, so the check
of pskb_may_pull(skb, xprth + 4 - skb->data) in _decode_session4() will
never return 0 because xprth + 4 - skb->data < 0, the ports decode of
sctp will always fail.
Signed-off-by: Wei Yongjun <yjwei@cn.fujitsu.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/xfrm4_policy.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c index 60d918c96a4f..0071ee6f441f 100644 --- a/net/ipv4/xfrm4_policy.c +++ b/net/ipv4/xfrm4_policy.c @@ -136,7 +136,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) case IPPROTO_TCP: case IPPROTO_SCTP: case IPPROTO_DCCP: - if (pskb_may_pull(skb, xprth + 4 - skb->data)) { + if (xprth + 4 < skb->data || + pskb_may_pull(skb, xprth + 4 - skb->data)) { __be16 *ports = (__be16 *)xprth; fl->fl_ip_sport = ports[!!reverse]; |