diff options
| author | Roland McGrath <roland@gnu.org> | 2000-02-05 12:21:17 +0000 |
|---|---|---|
| committer | Roland McGrath <roland@gnu.org> | 2000-02-05 12:21:17 +0000 |
| commit | e5f75e8ece5d1a8d3c17bd0156082caf153d3779 (patch) | |
| tree | 316ee48be396f95770ccd5511ea442b83cadca51 /pfinet/linux-src/net/ipv4/ip_input.c | |
| parent | b39cd08347c72483a4521a55301a0fa147a2a2b1 (diff) | |
| download | hurd-e5f75e8ece5d1a8d3c17bd0156082caf153d3779.tar.gz hurd-e5f75e8ece5d1a8d3c17bd0156082caf153d3779.tar.bz2 hurd-e5f75e8ece5d1a8d3c17bd0156082caf153d3779.zip | |
Import of Linux 2.2.14 subset (ipv4 stack and related)
Diffstat (limited to 'pfinet/linux-src/net/ipv4/ip_input.c')
| -rw-r--r-- | pfinet/linux-src/net/ipv4/ip_input.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/pfinet/linux-src/net/ipv4/ip_input.c b/pfinet/linux-src/net/ipv4/ip_input.c index b1725fa3..545f093c 100644 --- a/pfinet/linux-src/net/ipv4/ip_input.c +++ b/pfinet/linux-src/net/ipv4/ip_input.c @@ -97,6 +97,7 @@ * Alan Cox : Multicast routing hooks * Jos Vos : Do accounting *before* call_in_firewall * Willy Konynenberg : Transparent proxying support + * Stephan Uphoff : Check IP header length field * * * @@ -421,6 +422,10 @@ int ip_rcv(struct sk_buff *skb, struct device *dev, struct packet_type *pt) if (skb->len < sizeof(struct iphdr)) goto inhdr_error; + + if (skb->len < (iph->ihl << 2)) + goto inhdr_error; + if (iph->ihl < 5 || iph->version != 4 || ip_fast_csum((u8 *)iph, iph->ihl) != 0) goto inhdr_error; @@ -429,6 +434,9 @@ int ip_rcv(struct sk_buff *skb, struct device *dev, struct packet_type *pt) if (skb->len < len) goto inhdr_error; + if (len < (iph->ihl << 2)) + goto inhdr_error; + /* * Our transport medium may have padded the buffer out. Now we know it * is IP we can trim to the true length of the frame. |