Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8b5cc5ef authored Aug 07, 2006 by Stephen Hemminger Committed by David S. Miller Aug 07, 2006

[IPX]: Header length validation needed



This patch will linearize and check there is enough data.
It handles the pprop case as well as avoiding a whole audit of
the routing code.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent d14cc9a3

net/ipx/af_ipx.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1646,7 +1646,8 @@ static int ipx_rcv(struct sk_buff skb, struct net_device dev, struct packet_ty
		ipx_pktsize = ntohs(ipx->ipx_pktsize);

		/* Too small or invalid header? */
		if (ipx_pktsize < sizeof(struct ipxhdr) \|\| ipx_pktsize > skb->len)
		if (ipx_pktsize < sizeof(struct ipxhdr) \|\|
		!pskb_may_pull(skb, ipx_pktsize))
		goto drop;

		if (ipx->ipx_checksum != IPX_NO_CHECKSUM &&