[IPV6] ADDRCONF: Check payload length for IFA_LOCAL attribute in RTM_{ADD,DEL}MSG message
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
This commit is contained in:
parent
a205729e2c
commit
643162258e
|
@ -2853,7 +2853,8 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
|
|||
pfx = RTA_DATA(rta[IFA_ADDRESS-1]);
|
||||
}
|
||||
if (rta[IFA_LOCAL-1]) {
|
||||
if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx)))
|
||||
if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*pfx) ||
|
||||
(pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))))
|
||||
return -EINVAL;
|
||||
pfx = RTA_DATA(rta[IFA_LOCAL-1]);
|
||||
}
|
||||
|
@ -2877,7 +2878,8 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
|
|||
pfx = RTA_DATA(rta[IFA_ADDRESS-1]);
|
||||
}
|
||||
if (rta[IFA_LOCAL-1]) {
|
||||
if (pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx)))
|
||||
if (RTA_PAYLOAD(rta[IFA_LOCAL-1]) < sizeof(*pfx) ||
|
||||
(pfx && memcmp(pfx, RTA_DATA(rta[IFA_LOCAL-1]), sizeof(*pfx))))
|
||||
return -EINVAL;
|
||||
pfx = RTA_DATA(rta[IFA_LOCAL-1]);
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue