Skip to content

Commit

Permalink
cls_rsvp: add sanity check for the packet length
Browse files Browse the repository at this point in the history
The packet length should be checked before the packet data is dereferenced.

Signed-off-by: Changli Gao <xiaosuo@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Changli Gao authored and David S. Miller committed Aug 5, 2010
1 parent 4b95c3d commit 12dc96d
Showing 1 changed file with 10 additions and 2 deletions.
12 changes: 10 additions & 2 deletions net/sched/cls_rsvp.h
Original file line number Diff line number Diff line change
@@ -143,9 +143,17 @@ static int rsvp_classify(struct sk_buff *skb, struct tcf_proto *tp,
u8 tunnelid = 0;
u8 *xprt;
#if RSVP_DST_LEN == 4
struct ipv6hdr *nhptr = ipv6_hdr(skb);
struct ipv6hdr *nhptr;

if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
return -1;
nhptr = ipv6_hdr(skb);
#else
struct iphdr *nhptr = ip_hdr(skb);
struct iphdr *nhptr;

if (!pskb_network_may_pull(skb, sizeof(*nhptr)))
return -1;
nhptr = ip_hdr(skb);
#endif

restart:

0 comments on commit 12dc96d

Please sign in to comment.