diff options
-rw-r--r-- | net/core/filter.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/core/filter.c b/net/core/filter.c index e193e29d4671..e8a6ac411ffb 100644 --- a/net/core/filter.c +++ b/net/core/filter.c | |||
@@ -88,7 +88,7 @@ enum { | |||
88 | }; | 88 | }; |
89 | 89 | ||
90 | /* No hurry in this branch */ | 90 | /* No hurry in this branch */ |
91 | static void *__load_pointer(const struct sk_buff *skb, int k) | 91 | static void *__load_pointer(const struct sk_buff *skb, int k, unsigned int size) |
92 | { | 92 | { |
93 | u8 *ptr = NULL; | 93 | u8 *ptr = NULL; |
94 | 94 | ||
@@ -97,7 +97,7 @@ static void *__load_pointer(const struct sk_buff *skb, int k) | |||
97 | else if (k >= SKF_LL_OFF) | 97 | else if (k >= SKF_LL_OFF) |
98 | ptr = skb_mac_header(skb) + k - SKF_LL_OFF; | 98 | ptr = skb_mac_header(skb) + k - SKF_LL_OFF; |
99 | 99 | ||
100 | if (ptr >= skb->head && ptr < skb_tail_pointer(skb)) | 100 | if (ptr >= skb->head && ptr + size <= skb_tail_pointer(skb)) |
101 | return ptr; | 101 | return ptr; |
102 | return NULL; | 102 | return NULL; |
103 | } | 103 | } |
@@ -110,7 +110,7 @@ static inline void *load_pointer(const struct sk_buff *skb, int k, | |||
110 | else { | 110 | else { |
111 | if (k >= SKF_AD_OFF) | 111 | if (k >= SKF_AD_OFF) |
112 | return NULL; | 112 | return NULL; |
113 | return __load_pointer(skb, k); | 113 | return __load_pointer(skb, k, size); |
114 | } | 114 | } |
115 | } | 115 | } |
116 | 116 | ||