Commit a76ec104 authored by Krishna Kumar's avatar Krishna Kumar Committed by David S. Miller

[IPV6]: Error is option length increases amidst corking.

parent d56dc016
...@@ -821,6 +821,9 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse ...@@ -821,6 +821,9 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse
sk->sk_allocation); sk->sk_allocation);
if (unlikely(np->cork.opt == NULL)) if (unlikely(np->cork.opt == NULL))
return -ENOBUFS; return -ENOBUFS;
} else if (np->cork.opt->tot_len < opt->tot_len) {
printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
return -EINVAL;
} }
memcpy(np->cork.opt, opt, opt->tot_len); memcpy(np->cork.opt, opt, opt->tot_len);
inet->cork.flags |= IPCORK_OPT; inet->cork.flags |= IPCORK_OPT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment