diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2008-01-05 23:14:44 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-01-08 23:29:57 -0800 |
| commit | f844c74fe07321953e2dd227fe35280075f18f60 (patch) | |
| tree | 045fedb426c7990ad254520cb413010acbbe0ab8 /net | |
| parent | cb77df3ec88f07c6141924dfe6fd96a2f541cc09 (diff) | |
| download | linux-3.10-f844c74fe07321953e2dd227fe35280075f18f60.tar.gz linux-3.10-f844c74fe07321953e2dd227fe35280075f18f60.tar.bz2 linux-3.10-f844c74fe07321953e2dd227fe35280075f18f60.zip | |
[IPV4] raw: Strengthen check on validity of iph->ihl
We currently check that iph->ihl is bounded by the real length and that
the real length is greater than the minimum IP header length. However,
we did not check the caes where iph->ihl is less than the minimum IP
header length.
This breaks because some ip_fast_csum implementations assume that which
is quite reasonable.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv4/raw.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 66b42f547bf..e7050f8eabe 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -271,6 +271,7 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length, int hh_len; struct iphdr *iph; struct sk_buff *skb; + unsigned int iphlen; int err; if (length > rt->u.dst.dev->mtu) { @@ -304,7 +305,8 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length, goto error_fault; /* We don't modify invalid header */ - if (length >= sizeof(*iph) && iph->ihl * 4U <= length) { + iphlen = iph->ihl * 4; + if (iphlen >= sizeof(*iph) && iphlen <= length) { if (!iph->saddr) iph->saddr = rt->rt_src; iph->check = 0; |