dany/u-boot-megous
1
0
Fork 0
mirror of https://xff.cz/git/u-boot/ synced 2025-10-27 00:24:09 +01:00
Code Issues Packages Projects Releases Wiki Activity

net: ipv6: router advertisement message length should be within limits

Browse Source 
The argument len passed to function process_ra is the length of the IPv6
router advertisement message and needs to be between 0 and MTU because
it is assigned to remaining_option_len and used as a loop variable.

Addresses-Coverity-ID: 450971 ("TAINTED_SCALAR")
Signed-off-by: Ehsan Mohandesi <emohandesi@linux.microsoft.com>
Reviewed-by: Viacheslav Mitrofanov <v.v.mitrofanov@yadro.com>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>
This commit is contained in:
Ehsan Mohandesi
2023-05-18 11:24:38 -07:00
committed by Tom Rini
parent c98c401dfb
commit a29df56eab
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
net/ndisc.c
View File

@@ -382,6 +382,8 @@ int process_ra(struct ip6_hdr *ip6, int len)
unsigned char type = 0; unsigned char type = 0;
struct icmp6_ra_prefix_info *prefix = NULL; struct icmp6_ra_prefix_info *prefix = NULL;
if (len > ETH_MAX_MTU)
return -EMSGSIZE;
/* Ignore the packet if router lifetime is 0. */ /* Ignore the packet if router lifetime is 0. */
if (!icmp->icmp6_rt_lifetime) if (!icmp->icmp6_rt_lifetime)
return -EOPNOTSUPP; return -EOPNOTSUPP;