[PATCH net-next] ndisc: Check NS message length before access.
From: YOSHIFUJI Hideaki <hidden>
Date: 2013-01-18 12:05:04
Subsystem:
networking [general], networking [ipv4/ipv6], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Ahern, Ido Schimmel, Linus Torvalds
Check message length before accessing "target" field, as we do for other types. Signed-off-by: YOSHIFUJI Hideaki <redacted> --- net/ipv6/ndisc.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 429622d..350f860 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c@@ -671,6 +671,11 @@ static void ndisc_recv_ns(struct sk_buff *skb) bool inc; int is_router = -1; + if (skb->len < sizeof(struct nd_msg)) { + ND_PRINTK(2, warn, "NS: packet too short\n"); + return; + } + if (ipv6_addr_is_multicast(&msg->target)) { ND_PRINTK(2, warn, "NS: multicast target address\n"); return;
--
1.7.9.5