Subject: Re: [PATCH] ipx: header length validation needed

From: Stephen Hemminger <[email-masked]>
Date: Mon, 7 Aug 2006 16:36:02 -0700

This patch will linearize and check there is enough data.
It handles the pprop case as well as avoiding a whole audit of
the routing code.

Signed-off-by: Stephen Hemminger <[email-masked]>

--- a/net/ipx/af_ipx.c	2006-08-07 13:45:59.000000000 -0700
+++ b/net/ipx/af_ipx.c	2006-08-07 16:34:00.000000000 -0700
@@ -1649,7 +1649,8 @@
 	ipx_pktsize	= ntohs(ipx->ipx_pktsize);
 	
 	/* Too small or invalid header? */
-	if (ipx_pktsize < sizeof(struct ipxhdr) || ipx_pktsize > skb->len)
+	if (ipx_pktsize < sizeof(struct ipxhdr)
+	   || !pskb_may_pull(skb, ipx_pktsize))
 		goto drop;
                         
 	if (ipx->ipx_checksum != IPX_NO_CHECKSUM &&