From cfffddeac504190914dc41f7fe5c7cb42bdc1ea6 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 26 Nov 2018 22:12:07 +0100 Subject: sd-radv: when receiving a too short packet, make sure we dequeue it --- src/libsystemd-network/sd-radv.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'src/libsystemd-network/sd-radv.c') diff --git a/src/libsystemd-network/sd-radv.c b/src/libsystemd-network/sd-radv.c index f256cbc984..7b51f28ff2 100644 --- a/src/libsystemd-network/sd-radv.c +++ b/src/libsystemd-network/sd-radv.c @@ -229,9 +229,8 @@ static int radv_recv(sd_event_source *s, int fd, uint32_t revents, void *userdat assert(ra->event); buflen = next_datagram_size_fd(fd); - - if ((unsigned) buflen < sizeof(struct nd_router_solicit)) - return log_radv("Too short packet received"); + if (buflen < 0) + return (int) buflen; buf = new0(char, buflen); if (!buf) @@ -264,6 +263,11 @@ static int radv_recv(sd_event_source *s, int fd, uint32_t revents, void *userdat return 0; } + if ((size_t) buflen < sizeof(struct nd_router_solicit)) { + log_radv("Too short packet received"); + return 0; + } + (void) in_addr_to_string(AF_INET6, (union in_addr_union*) &src, &addr); r = radv_send(ra, &src, ra->lifetime); -- cgit v1.2.3