* [PATCH net-next] ndisc: Check NS message length before access.
@ 2013-01-18 12:05 YOSHIFUJI Hideaki
2013-01-18 19:42 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: YOSHIFUJI Hideaki @ 2013-01-18 12:05 UTC (permalink / raw)
To: David Miller, netdev; +Cc: YOSHIFUJI Hideaki
Check message length before accessing "target" field,
as we do for other types.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6•org>
---
net/ipv6/ndisc.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 429622d..350f860 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -671,6 +671,11 @@ static void ndisc_recv_ns(struct sk_buff *skb)
bool inc;
int is_router = -1;
+ if (skb->len < sizeof(struct nd_msg)) {
+ ND_PRINTK(2, warn, "NS: packet too short\n");
+ return;
+ }
+
if (ipv6_addr_is_multicast(&msg->target)) {
ND_PRINTK(2, warn, "NS: multicast target address\n");
return;
--
1.7.9.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net-next] ndisc: Check NS message length before access.
2013-01-18 12:05 [PATCH net-next] ndisc: Check NS message length before access YOSHIFUJI Hideaki
@ 2013-01-18 19:42 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2013-01-18 19:42 UTC (permalink / raw)
To: yoshfuji; +Cc: netdev
From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6•org>
Date: Fri, 18 Jan 2013 21:05:03 +0900
> Check message length before accessing "target" field,
> as we do for other types.
>
> Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6•org>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-01-18 19:42 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-01-18 12:05 [PATCH net-next] ndisc: Check NS message length before access YOSHIFUJI Hideaki
2013-01-18 19:42 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox