diff options
| author | Paul Mackerras <paulus@samba.org> | 2007-04-13 03:50:03 +1000 |
|---|---|---|
| committer | Paul Mackerras <paulus@samba.org> | 2007-04-13 03:50:03 +1000 |
| commit | e049d1ca3094f3d1d94617f456a9961202f96e3a (patch) | |
| tree | a30397ad22f2fbea268bd28fa69c60aad9dfa62a /net/appletalk/ddp.c | |
| parent | edfac96a92b88d3b0b53e3f8231b74beee9ecd1d (diff) | |
| parent | 80584ff3b99c36ead7e130e453b3a48b18072d18 (diff) | |
Merge branch 'linux-2.6' into for-2.6.22
Diffstat (limited to 'net/appletalk/ddp.c')
| -rw-r--r-- | net/appletalk/ddp.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c index 113c175f171..c8b7dc2c325 100644 --- a/net/appletalk/ddp.c +++ b/net/appletalk/ddp.c @@ -1417,10 +1417,13 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev, /* * Size check to see if ddp->deh_len was crap * (Otherwise we'll detonate most spectacularly - * in the middle of recvmsg()). + * in the middle of atalk_checksum() or recvmsg()). */ - if (skb->len < sizeof(*ddp)) + if (skb->len < sizeof(*ddp) || skb->len < (len_hops & 1023)) { + pr_debug("AppleTalk: dropping corrupted frame (deh_len=%u, " + "skb->len=%u)\n", len_hops & 1023, skb->len); goto freeit; + } /* * Any checksums. Note we don't do htons() on this == is assumed to be |