1 files changed, 13 insertions, 1 deletions

diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index 24a342ebc7f5..5170d52bfd96 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -269,7 +269,11 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q,
                int *d, int *m)
 {
         struct x25_sock *x25 = x25_sk(sk);
-        unsigned char *frame = skb->data;
+        unsigned char *frame;
+
+        if (!pskb_may_pull(skb, X25_STD_MIN_LEN))
+                return X25_ILLEGAL;
+        frame = skb->data;
 
         *ns = *nr = *q = *d = *m = 0;
 
@@ -294,6 +298,10 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q,
                 if (frame[2] == X25_RR  ||
                     frame[2] == X25_RNR ||
                     frame[2] == X25_REJ) {
+                        if (!pskb_may_pull(skb, X25_EXT_MIN_LEN))
+                                return X25_ILLEGAL;
+                        frame = skb->data;
+
                         *nr = (frame[3] >> 1) & 0x7F;
                         return frame[2];
                 }
@@ -308,6 +316,10 @@ int x25_decode(struct sock *sk, struct sk_buff *skb, int *ns, int *nr, int *q,
 
         if (x25->neighbour->extended) {
                 if ((frame[2] & 0x01) == X25_DATA) {
+                        if (!pskb_may_pull(skb, X25_EXT_MIN_LEN))
+                                return X25_ILLEGAL;
+                        frame = skb->data;
+
                         *q  = (frame[0] & X25_Q_BIT) == X25_Q_BIT;
                         *d  = (frame[0] & X25_D_BIT) == X25_D_BIT;
                         *m  = (frame[3] & X25_EXT_M_BIT) == X25_EXT_M_BIT;