From 8ea9025b029f8af1ebdcbd5c19c82ed0dd060b36 Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Sun, 16 Oct 2011 20:32:03 +0200 Subject: [PATCH] --- yaml --- r: 277945 b: refs/heads/master c: 8b7342d673d31e7aa60baae35321c11532275cdb h: refs/heads/master i: 277943: 6cc522b04d5120496f4c4f9567458292c389fd1b v: v3 --- [refs] | 2 +- trunk/net/batman-adv/routing.c | 9 +++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/[refs] b/[refs] index f737ddcc046a..75c1fdf86021 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: dc58fe32e6a4fbd270e8f045225ce475073d0772 +refs/heads/master: 8b7342d673d31e7aa60baae35321c11532275cdb diff --git a/trunk/net/batman-adv/routing.c b/trunk/net/batman-adv/routing.c index e0e7b7b79ca9..ef24a7205f65 100644 --- a/trunk/net/batman-adv/routing.c +++ b/trunk/net/batman-adv/routing.c @@ -578,6 +578,7 @@ int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if) { struct bat_priv *bat_priv = netdev_priv(recv_if->soft_iface); struct tt_query_packet *tt_query; + uint16_t tt_len; struct ethhdr *ethhdr; /* drop packet if it has not necessary minimum size */ @@ -622,6 +623,14 @@ int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if) if (skb_linearize(skb) < 0) goto out; + tt_len = tt_query->tt_data * sizeof(struct tt_change); + + /* Ensure we have all the claimed data */ + if (unlikely(skb_headlen(skb) < + sizeof(struct tt_query_packet) + + tt_len)) + goto out; + handle_tt_response(bat_priv, tt_query); } else { bat_dbg(DBG_TT, bat_priv,