Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64316225 authored by YOSHIFUJI Hideaki's avatar YOSHIFUJI Hideaki Committed by David S. Miller
Browse files

[IPV6] ADDRCONF: Check payload length for IFA_LOCAL attribute in RTM_{ADD,DEL}MSG message 



Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
parent a205729e

net/ipv6/addrconf.c

+4 −2
Original line number Diff line number Diff line
@@ -2853,7 +2853,8 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) 
		pfx = RTA_DATA(rta[IFA_ADDRESS-1]);

	}

	if (rta[IFA_LOCAL-1]) {

		if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx)))

		if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*pfx) ||

		    (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))))

			return -EINVAL;

		pfx = RTA_DATA(rta[IFA_LOCAL-1]);

	}
@@ -2877,7 +2878,8 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) 
		pfx = RTA_DATA(rta[IFA_ADDRESS-1]);

	}

	if (rta[IFA_LOCAL-1]) {

		if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx)))

		if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*pfx) ||

		    (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))))

			return -EINVAL;

		pfx = RTA_DATA(rta[IFA_LOCAL-1]);

	}