Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 97300b5f authored by Yan Zheng's avatar Yan Zheng Committed by Arnaldo Carvalho de Melo
Browse files

[MCAST] IPv6: Check packet size when process Multicast 



Signed-off-by: default avatarYan Zheng <yanzheng@21cn.com>
Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@mandriva.com>
parent edc9e819

net/ipv6/mcast.c

+17 −2
Original line number Diff line number Diff line
@@ -1087,7 +1087,7 @@ static void mld_marksources(struct ifmcaddr6 *pmc, int nsrcs, 


int igmp6_event_query(struct sk_buff *skb)

{

	struct mld2_query *mlh2 = (struct mld2_query *) skb->h.raw;

	struct mld2_query *mlh2 = NULL;

	struct ifmcaddr6 *ma;

	struct in6_addr *group;

	unsigned long max_delay;
@@ -1140,6 +1140,13 @@ int igmp6_event_query(struct sk_buff *skb) 
		/* clear deleted report items */

		mld_clear_delrec(idev);

	} else if (len >= 28) {

		int srcs_offset = sizeof(struct mld2_query) - 

				  sizeof(struct icmp6hdr);

		if (!pskb_may_pull(skb, srcs_offset)) {

			in6_dev_put(idev);

			return -EINVAL;

		}

		mlh2 = (struct mld2_query *) skb->h.raw;

		max_delay = (MLDV2_MRC(ntohs(mlh2->mrc))*HZ)/1000;

		if (!max_delay)

			max_delay = 1;
@@ -1156,7 +1163,15 @@ int igmp6_event_query(struct sk_buff *skb) 
			return 0;

		}

		/* mark sources to include, if group & source-specific */

		mark = mlh2->nsrcs != 0;

		if (mlh2->nsrcs != 0) {

			if (!pskb_may_pull(skb, srcs_offset + 

				mlh2->nsrcs * sizeof(struct in6_addr))) {

				in6_dev_put(idev);

				return -EINVAL;

			}

			mlh2 = (struct mld2_query *) skb->h.raw;

			mark = 1;

		}

	} else {

		in6_dev_put(idev);

		return -EINVAL;