Skip to content

L
linux
Commit 88df8de5 authored by Hideaki Yoshifuji's avatar Hideaki Yoshifuji Committed by David S. Miller
Browse files
Options

[IPV6]: Fix payload length of reassembled packet.

parent c7065272
Hide whitespace changes
Inline Side-by-side
Showing with 2 additions and 4 deletions
net/ipv6/reassembly.c
View file @ 88df8de5
...@@ -596,10 +596,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in, ...@@ -596,10 +596,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff **skb_in,
BUG_TRAP(FRAG6_CB(head)->offset == 0); BUG_TRAP(FRAG6_CB(head)->offset == 0);
/* Unfragmented part is taken from the first segment. */ /* Unfragmented part is taken from the first segment. */
payload_len = (head->data - head->nh.raw) - sizeof(struct ipv6hdr) + fq->len; payload_len = (head->data - head->nh.raw) - sizeof(struct ipv6hdr) + fq->len - 8;
nhoff = head->h.raw - head->nh.raw; if (payload_len > 65535)
if (payload_len > 65535 + 8)
goto out_oversize; goto out_oversize;
/* Head of list must not be cloned. */ /* Head of list must not be cloned. */
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7