Commit 115b0aa6 authored by YOSHIFUJI Hideaki / 吉藤英明's avatar YOSHIFUJI Hideaki / 吉藤英明 Committed by David S. Miller
Browse files

ndisc: Check NS message length before access. 



Check message length before accessing "target" field,
as we do for other types.

Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 12fd84f4

net/ipv6/ndisc.c

+5 −0
Original line number Diff line number Diff line
@@ -671,6 +671,11 @@ static void ndisc_recv_ns(struct sk_buff *skb) 
	bool inc;

	int is_router = -1;



	if (skb->len < sizeof(struct nd_msg)) {

		ND_PRINTK(2, warn, "NS: packet too short\n");

		return;

	}



	if (ipv6_addr_is_multicast(&msg->target)) {

		ND_PRINTK(2, warn, "NS: multicast target address\n");

		return;