[IPV6]: Error is option length increases amidst corking.

a76ec104 · Krishna Kumar · David S. Miller · d56dc016 · a76ec104
Commit a76ec104 authored Mar 23, 2004 by Krishna Kumar Committed by David S. Miller Mar 23, 2004
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 0 deletions

net/ipv6/ip6_output.c net/ipv6/ip6_output.c +3 -0

No files found.
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -821,6 +821,9 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse
 						       sk->sk_allocation);
 				if (unlikely(np->cork.opt == NULL))
 					return -ENOBUFS;
+			} else if (np->cork.opt->tot_len < opt->tot_len) {
+				printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
+				return -EINVAL;
 			}
 			memcpy(np->cork.opt, opt, opt->tot_len);
 			inet->cork.flags |= IPCORK_OPT;