diff options
| author | YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> | 2006-07-28 05:12:09 -0400 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-08-02 16:38:08 -0400 |
| commit | 643162258e57180a33e0ef7f08f0d986fbb5b4b9 (patch) | |
| tree | e66a0348076afe5e37c49bc5de0d76dc3e2763d0 /net/ipv6/addrconf.c | |
| parent | a205729e2cd8e51257cd0ea738524c64da99b9e0 (diff) | |
[IPV6] ADDRCONF: Check payload length for IFA_LOCAL attribute in RTM_{ADD,DEL}MSG message
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Diffstat (limited to 'net/ipv6/addrconf.c')
| -rw-r--r-- | net/ipv6/addrconf.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 2316a4315a18..81702b9ba5be 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c | |||
| @@ -2853,7 +2853,8 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) | |||
| 2853 | pfx = RTA_DATA(rta[IFA_ADDRESS-1]); | 2853 | pfx = RTA_DATA(rta[IFA_ADDRESS-1]); |
| 2854 | } | 2854 | } |
| 2855 | if (rta[IFA_LOCAL-1]) { | 2855 | if (rta[IFA_LOCAL-1]) { |
| 2856 | if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))) | 2856 | if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*pfx) || |
| 2857 | (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx)))) | ||
| 2857 | return -EINVAL; | 2858 | return -EINVAL; |
| 2858 | pfx = RTA_DATA(rta[IFA_LOCAL-1]); | 2859 | pfx = RTA_DATA(rta[IFA_LOCAL-1]); |
| 2859 | } | 2860 | } |
| @@ -2877,7 +2878,8 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) | |||
| 2877 | pfx = RTA_DATA(rta[IFA_ADDRESS-1]); | 2878 | pfx = RTA_DATA(rta[IFA_ADDRESS-1]); |
| 2878 | } | 2879 | } |
| 2879 | if (rta[IFA_LOCAL-1]) { | 2880 | if (rta[IFA_LOCAL-1]) { |
| 2880 | if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))) | 2881 | if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*pfx) || |
| 2882 | (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx)))) | ||
| 2881 | return -EINVAL; | 2883 | return -EINVAL; |
| 2882 | pfx = RTA_DATA(rta[IFA_LOCAL-1]); | 2884 | pfx = RTA_DATA(rta[IFA_LOCAL-1]); |
| 2883 | } | 2885 | } |