Skip to content

L
linux-davinci
Commit 64316225 authored by YOSHIFUJI Hideaki's avatar YOSHIFUJI Hideaki Committed by David S. Miller
Browse files
Options

[IPV6] ADDRCONF: Check payload length for IFA_LOCAL attribute in RTM_{ADD,DEL}MSG message 

Signed-off-by: default avatarYOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
parent a205729e
Hide whitespace changes
Inline Side-by-side
Showing with 4 additions and 2 deletions
net/ipv6/addrconf.c
View file @ 64316225
...@@ -2853,7 +2853,8 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) ...@@ -2853,7 +2853,8 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
pfx = RTA_DATA(rta[IFA_ADDRESS-1]); pfx = RTA_DATA(rta[IFA_ADDRESS-1]);
} }
if (rta[IFA_LOCAL-1]) { if (rta[IFA_LOCAL-1]) {
if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))) if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*pfx) ||
(pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))))
return -EINVAL; return -EINVAL;
pfx = RTA_DATA(rta[IFA_LOCAL-1]); pfx = RTA_DATA(rta[IFA_LOCAL-1]);
} }
...@@ -2877,7 +2878,8 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg) ...@@ -2877,7 +2878,8 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
pfx = RTA_DATA(rta[IFA_ADDRESS-1]); pfx = RTA_DATA(rta[IFA_ADDRESS-1]);
} }
if (rta[IFA_LOCAL-1]) { if (rta[IFA_LOCAL-1]) {
if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))) if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*pfx) ||
(pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))))
return -EINVAL; return -EINVAL;
pfx = RTA_DATA(rta[IFA_LOCAL-1]); pfx = RTA_DATA(rta[IFA_LOCAL-1]);
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment