From 067376dad21c89c71013d56bc833af965cb68b01 Mon Sep 17 00:00:00 2001
From: Stephen Hemminger <shemminger@osdl.org>
Date: Tue, 8 Aug 2006 16:48:51 -0700
Subject: [PATCH] --- yaml --- r: 33309 b: refs/heads/master c:
 7b1ba8de569460894efa892457af7a37c0d574f9 h: refs/heads/master i:   33307:
 1877b056c53b7ef2725fbaf2d472ed0ddab55455 v: v3

---
 [refs]                 | 2 +-
 trunk/net/ipx/af_ipx.c | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/[refs] b/[refs]
index 3afc9d36e65f..7a123019a91f 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 70f8e78e150425b01c1099087ad3decacf7e4ccf
+refs/heads/master: 7b1ba8de569460894efa892457af7a37c0d574f9
diff --git a/trunk/net/ipx/af_ipx.c b/trunk/net/ipx/af_ipx.c
index c13e86b14f69..401964204866 100644
--- a/trunk/net/ipx/af_ipx.c
+++ b/trunk/net/ipx/af_ipx.c
@@ -1642,14 +1642,17 @@ static int ipx_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_ty
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		goto out;
 
-	ipx		= ipx_hdr(skb);
-	ipx_pktsize	= ntohs(ipx->ipx_pktsize);
+	if (!pskb_may_pull(skb, sizeof(struct ipxhdr)))
+		goto drop;
+
+	ipx_pktsize = ntohs(ipxhdr(skb)->ipx_pktsize);
 	
 	/* Too small or invalid header? */
 	if (ipx_pktsize < sizeof(struct ipxhdr) ||
 	    !pskb_may_pull(skb, ipx_pktsize))
 		goto drop;
                         
+	ipx = ipx_hdr(skb);
 	if (ipx->ipx_checksum != IPX_NO_CHECKSUM &&
 	   ipx->ipx_checksum != ipx_cksum(ipx, ipx_pktsize))
 		goto drop;