Subject: [PATCH] ipv6: Keep index within tab_unreach[]

From: Roel Kluin <[email-masked]>
Date: Tue, 16 Jun 2009 20:40:21 +0200

Ensure that index `code' remains within array tab_unreach[]

Signed-off-by: Roel Kluin <[email-masked]>
---
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 36dff88..8f850de 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -923,7 +923,7 @@ int icmpv6_err_convert(int type, int code, int *err)
 	switch (type) {
 	case ICMPV6_DEST_UNREACH:
 		fatal = 1;
-		if (code <= ICMPV6_PORT_UNREACH) {
+		if (code <= ICMPV6_PORT_UNREACH && code >= 0) {
 			*err  = tab_unreach[code].err;
 			fatal = tab_unreach[code].fatal;
 		}