diff options
| -rw-r--r-- | net/ipv6/netfilter/nf_conntrack_reasm.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c index ed4d79a9e4a6..058a5e4a60c3 100644 --- a/net/ipv6/netfilter/nf_conntrack_reasm.c +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c | |||
| @@ -528,14 +528,14 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff) | |||
| 528 | if (!ipv6_ext_hdr(nexthdr)) { | 528 | if (!ipv6_ext_hdr(nexthdr)) { |
| 529 | return -1; | 529 | return -1; |
| 530 | } | 530 | } |
| 531 | if (len < (int)sizeof(struct ipv6_opt_hdr)) { | ||
| 532 | pr_debug("too short\n"); | ||
| 533 | return -1; | ||
| 534 | } | ||
| 535 | if (nexthdr == NEXTHDR_NONE) { | 531 | if (nexthdr == NEXTHDR_NONE) { |
| 536 | pr_debug("next header is none\n"); | 532 | pr_debug("next header is none\n"); |
| 537 | return -1; | 533 | return -1; |
| 538 | } | 534 | } |
| 535 | if (len < (int)sizeof(struct ipv6_opt_hdr)) { | ||
| 536 | pr_debug("too short\n"); | ||
| 537 | return -1; | ||
| 538 | } | ||
| 539 | if (skb_copy_bits(skb, start, &hdr, sizeof(hdr))) | 539 | if (skb_copy_bits(skb, start, &hdr, sizeof(hdr))) |
| 540 | BUG(); | 540 | BUG(); |
| 541 | if (nexthdr == NEXTHDR_AUTH) | 541 | if (nexthdr == NEXTHDR_AUTH) |
