summaryrefslogtreecommitdiff
path: root/net/netlink/diag.c
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2016-11-02 19:00:40 -0700
committerDavid S. Miller <davem@davemloft.net>2016-11-03 16:16:51 -0400
commit6706a97fec963d6cb3f7fc2978ec1427b4651214 (patch)
treecbe6c56ae8eadfb5472dc23fade4158f5e311120 /net/netlink/diag.c
parent346da62cc186c4b4b1ac59f87f4482b47a047388 (diff)
dccp: fix out of bound access in dccp_v4_err()
dccp_v4_err() does not use pskb_may_pull() and might access garbage. We only need 4 bytes at the beginning of the DCCP header, like TCP, so the 8 bytes pulled in icmp_socket_deliver() are more than enough. This patch might allow to process more ICMP messages, as some routers are still limiting the size of reflected bytes to 28 (RFC 792), instead of extended lengths (RFC 1812 4.3.2.3) Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/netlink/diag.c')
0 files changed, 0 insertions, 0 deletions