ndisc: Check NS message length before access.

PATCH Applied YOSHIFUJI Hideaki 2 participants 2 messages Jan 18, 2013

Subsystems (3)

Networking Network drivers IPv4/IPv6

lore

Share & tools

lore

YOSHIFUJI Hideaki

author

2013-01-18 12:05 UTC #0 lore raw

PATCH 1/1 ndisc: Check NS message length before access.

Check message length before accessing "target" field, as we do for other types.

Signed-off-by YOSHIFUJI Hideaki <[email protected]>

---
 net/ipv6/ndisc.c |    5 +++++
 1 file changed, 5 insertions(+)

net/ipv6/ndisc.c +5 -0

index 429622d..350f860 100644
@@ -671,6 +671,11 @@ static void ndisc_recv_ns(struct sk_buff *skb)
 	bool inc;
 	int is_router = -1;
 
+	if (skb->len < sizeof(struct nd_msg)) {
+		ND_PRINTK(2, warn, "NS: packet too short\n");
+		return;
+	}
+
 	if (ipv6_addr_is_multicast(&msg->target)) {
 		ND_PRINTK(2, warn, "NS: multicast target address\n");
 		return;

Signature · 1 line

1.7.9.5

David Miller

maintainer Applied

2013-01-18 19:42 UTC #1 lore raw

From: YOSHIFUJI Hideaki <[email protected]>
Date: Fri, 18 Jan 2013 21:05:03 +0900

Quoted 4 lines

Check message length before accessing "target" field, as we do for other types.
Signed-off-by YOSHIFUJI Hideaki <[email protected]>

Applied.