Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3be550f3 authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[UDP]: Fix length check. 



Rémi Denis-Courmont wrote:
> Right. By the way, shouldn't "len" rather be signed in there?
> 
> 		unsigned int len;
> 
> 		/* if we're overly short, let UDP handle it */
> 		len = skb->len - sizeof(struct udphdr);
> 		if (len <= 0)
> 			goto udp;

It should, but the < 0 case can't happen since __udp4_lib_rcv
already makes sure that we have at least a complete UDP header.

Anyways, this patch fixes it.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent dffe4f04

net/ipv4/udp.c

+2 −7
Original line number Diff line number Diff line
@@ -951,14 +951,10 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb) 
		 * >0 if skb should be passed on to UDP.

		 * <0 if skb should be resubmitted as proto -N

		 */

		unsigned int len;



		/* if we're overly short, let UDP handle it */

		len = skb->len - sizeof(struct udphdr);

		if (len <= 0)

			goto udp;



		if (up->encap_rcv != NULL) {

		if (skb->len > sizeof(struct udphdr) &&

		    up->encap_rcv != NULL) {

			int ret;



			ret = (*up->encap_rcv)(sk, skb);
@@ -971,7 +967,6 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb) 
		/* FALLTHROUGH -- it's a UDP Packet */

	}



udp:

	/*

	 * 	UDP-Lite specific tests, ignored on UDP sockets

	 */