From e4b654ebc45dfad617e7c643e8bed7577fdfcb83 Mon Sep 17 00:00:00 2001
From: Shan Wei <shanwei@cn.fujitsu.com>
Date: Tue, 10 Jun 2008 15:50:55 +0800
Subject: [PATCH] --- yaml --- r: 98089 b: refs/heads/master c:
 e8766fc86b34d44a8c55a2f9d71da69e091b1ca4 h: refs/heads/master i:   98087:
 1f1af6b09a4456679438df0e7003e8874642acf7 v: v3

---
 [refs]                    | 2 +-
 trunk/net/ipv6/datagram.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index b95b9903cd09..5e82c8f7a994 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 36e3deae8ba84865fd9eb3f2f21bbc00d49b7544
+refs/heads/master: e8766fc86b34d44a8c55a2f9d71da69e091b1ca4
diff --git a/trunk/net/ipv6/datagram.c b/trunk/net/ipv6/datagram.c
index b9c2de84a8a2..0f0f94a40335 100644
--- a/trunk/net/ipv6/datagram.c
+++ b/trunk/net/ipv6/datagram.c
@@ -705,6 +705,11 @@ int datagram_send_ctl(struct net *net,
 			}
 
 			*hlimit = *(int *)CMSG_DATA(cmsg);
+			if (*hlimit < -1 || *hlimit > 0xff) {
+				err = -EINVAL;
+				goto exit_f;
+			}
+
 			break;
 
 		case IPV6_TCLASS: