diff options
| author | Jiri Pirko <jiri@resnulli.us> | 2013-03-16 17:33:23 +0100 |
|---|---|---|
| committer | Jiri Pirko <jiri@resnulli.us> | 2013-03-17 11:11:48 +0100 |
| commit | 4099a4e906dac41861064c52a9658da67e05cb59 (patch) | |
| tree | aa6b2e1512bf9c819ca0117242c5bd1403da1062 /libndp | |
| parent | 83d3a43b08496a4308aa8550b688934ed391ce42 (diff) | |
| download | libndp-4099a4e906dac41861064c52a9658da67e05cb59.tar.gz | |
lib: move len check into ndp_sock_recv
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Diffstat (limited to 'libndp')
| -rw-r--r-- | libndp/libndp.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libndp/libndp.c b/libndp/libndp.c index 219b646..c972533 100644 --- a/libndp/libndp.c +++ b/libndp/libndp.c @@ -1028,10 +1028,6 @@ static int ndp_process_ra(struct ndp *ndp, struct ndp_msg *msg) unsigned char *ptr; dbg(ndp, "rcvd RA, len: %luB", len); - if (len < sizeof(msgra->ra)) { - warn(ndp, "rcvd RA packet too short (%luB)", len); - return 0; - } msgra->ra = ndp_msg_payload(msg); ptr = ndp_msg_payload_opts(msg); @@ -1115,6 +1111,10 @@ static int ndp_sock_recv(struct ndp *ndp) goto free_msg; ndp_msg_init(msg, msg_type); + if (len < ndp_msg_type_info(i)->raw_struct_size) { + warn(ndp, "rcvd ND packet too short (%luB)", len); + return 0; + } switch (msg->icmp6_hdr->icmp6_type) { case ND_ROUTER_SOLICIT: err = ndp_process_rs(ndp, msg); |