redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

ndisc: Check NS message length before access. 

Check message length before accessing "target" field,
as we do for other types.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
hifive-unleashed-5.1
YOSHIFUJI Hideaki / 吉藤英明 2013-01-18 02:05:03 +00:00 committed by David S. Miller
parent 12fd84f438
commit 115b0aa6b4
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
net/ipv6/ndisc.c
View File

@ -671,6 +671,11 @@ static void ndisc_recv_ns(struct sk_buff *skb)
bool inc;
int is_router = -1;
if (skb->len < sizeof(struct nd_msg)) {
ND_PRINTK(2, warn, "NS: packet too short\n");
return;
}
if (ipv6_addr_is_multicast(&msg->target)) {
ND_PRINTK(2, warn, "NS: multicast target address\n");
return;