Commit d4787a15 authored Jul 11, 2012 by Tony Cheneau Committed by David S. Miller Jul 16, 2012

6lowpan: Fix null pointer dereference in UDP uncompression function

When a UDP packet gets fragmented, a crash will occur at reassembly time.
This is because skb->transport_header is not set during earlier period of fragment reassembly.
As a consequence, call to udp_hdr() return NULL and uh (which is NULL) gets
dereferenced without much test.

Signed-off-by: Tony Cheneau <tony.cheneau@amnesiak.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 6e5928f6

net/ieee802154/6lowpan.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -314,6 +314,9 @@ lowpan_uncompress_udp_header(struct sk_buff *skb)
		struct udphdr *uh = udp_hdr(skb);
		u8 tmp;

		if (!uh)
		goto err;

		if (lowpan_fetch_skb_u8(skb, &tmp))
		goto err;