diff options
| author | Patrick McHardy <kaber@trash.net> | 2007-07-10 23:06:43 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2007-07-10 23:06:43 -0700 |
| commit | 3be550f34b03e5eb762f74d447ebbeba97efbd6d (patch) | |
| tree | 07881880089af5f9d8dbea1444f09e34a0100ef1 /net | |
| parent | dffe4f048b420f1af0b10a6090add0c5ea69e585 (diff) | |
| download | linux-3.10-3be550f34b03e5eb762f74d447ebbeba97efbd6d.tar.gz linux-3.10-3be550f34b03e5eb762f74d447ebbeba97efbd6d.tar.bz2 linux-3.10-3be550f34b03e5eb762f74d447ebbeba97efbd6d.zip | |
[UDP]: Fix length check.
Rémi Denis-Courmont wrote:
> Right. By the way, shouldn't "len" rather be signed in there?
>
> unsigned int len;
>
> /* if we're overly short, let UDP handle it */
> len = skb->len - sizeof(struct udphdr);
> if (len <= 0)
> goto udp;
It should, but the < 0 case can't happen since __udp4_lib_rcv
already makes sure that we have at least a complete UDP header.
Anyways, this patch fixes it.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/udp.c | 9 |
1 files changed, 2 insertions, 7 deletions
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 4ec4a25a8d0..28355350fb6 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -951,14 +951,10 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb) * >0 if skb should be passed on to UDP. * <0 if skb should be resubmitted as proto -N */ - unsigned int len; /* if we're overly short, let UDP handle it */ - len = skb->len - sizeof(struct udphdr); - if (len <= 0) - goto udp; - - if (up->encap_rcv != NULL) { + if (skb->len > sizeof(struct udphdr) && + up->encap_rcv != NULL) { int ret; ret = (*up->encap_rcv)(sk, skb); @@ -971,7 +967,6 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb) /* FALLTHROUGH -- it's a UDP Packet */ } -udp: /* * UDP-Lite specific tests, ignored on UDP sockets */ |