Commit 115b0aa6 authored Jan 18, 2013 by YOSHIFUJI Hideaki / 吉藤英明 Committed by David S. Miller Jan 18, 2013

ndisc: Check NS message length before access.



Check message length before accessing "target" field,
as we do for other types.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 12fd84f4

net/ipv6/ndisc.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -671,6 +671,11 @@ static void ndisc_recv_ns(struct sk_buff *skb)
		bool inc;
		int is_router = -1;

		if (skb->len < sizeof(struct nd_msg)) {
		ND_PRINTK(2, warn, "NS: packet too short\n");
		return;
		}

		if (ipv6_addr_is_multicast(&msg->target)) {
		ND_PRINTK(2, warn, "NS: multicast target address\n");
		return;