diff options
-rw-r--r-- | net/ipv6/netfilter/nf_conntrack_reasm.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c index ed4d79a9e4a6..058a5e4a60c3 100644 --- a/net/ipv6/netfilter/nf_conntrack_reasm.c +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c | |||
@@ -528,14 +528,14 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff) | |||
528 | if (!ipv6_ext_hdr(nexthdr)) { | 528 | if (!ipv6_ext_hdr(nexthdr)) { |
529 | return -1; | 529 | return -1; |
530 | } | 530 | } |
531 | if (len < (int)sizeof(struct ipv6_opt_hdr)) { | ||
532 | pr_debug("too short\n"); | ||
533 | return -1; | ||
534 | } | ||
535 | if (nexthdr == NEXTHDR_NONE) { | 531 | if (nexthdr == NEXTHDR_NONE) { |
536 | pr_debug("next header is none\n"); | 532 | pr_debug("next header is none\n"); |
537 | return -1; | 533 | return -1; |
538 | } | 534 | } |
535 | if (len < (int)sizeof(struct ipv6_opt_hdr)) { | ||
536 | pr_debug("too short\n"); | ||
537 | return -1; | ||
538 | } | ||
539 | if (skb_copy_bits(skb, start, &hdr, sizeof(hdr))) | 539 | if (skb_copy_bits(skb, start, &hdr, sizeof(hdr))) |
540 | BUG(); | 540 | BUG(); |
541 | if (nexthdr == NEXTHDR_AUTH) | 541 | if (nexthdr == NEXTHDR_AUTH) |