| From stable-bounces@linux.kernel.org Mon Aug 7 16:37:01 2006 |
| Date: Mon, 7 Aug 2006 16:36:02 -0700 |
| From: Stephen Hemminger <shemminger@osdl.org> |
| To: David Miller <davem@davemloft.net> |
| Message-ID: <20060807163602.5c7a4a65@localhost.localdomain> |
| Cc: netdev@vger.kernel.org, stable@kernel.org, acme@ghostprotocols.net |
| Subject: ipx: header length validation needed |
| |
| From: Stephen Hemminger <shemminger@osdl.org> |
| |
| This patch will linearize and check there is enough data. |
| It handles the pprop case as well as avoiding a whole audit of |
| the routing code. |
| |
| Signed-off-by: Stephen Hemminger <shemminger@osdl.org> |
| |
| --- |
| net/ipx/af_ipx.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- linux-2.6.17.8.orig/net/ipx/af_ipx.c |
| +++ linux-2.6.17.8/net/ipx/af_ipx.c |
| @@ -1647,7 +1647,8 @@ static int ipx_rcv(struct sk_buff *skb, |
| ipx_pktsize = ntohs(ipx->ipx_pktsize); |
| |
| /* Too small or invalid header? */ |
| - if (ipx_pktsize < sizeof(struct ipxhdr) || ipx_pktsize > skb->len) |
| + if (ipx_pktsize < sizeof(struct ipxhdr) |
| + || !pskb_may_pull(skb, ipx_pktsize)) |
| goto drop; |
| |
| if (ipx->ipx_checksum != IPX_NO_CHECKSUM && |
