| Message ID | Z9KTIYVFwEIYXgd7@gondor.apana.org.au (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | xfrm: ipcomp: Call pskb_may_pull in ipcomp_input | expand |
diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c index 9c0fa0e1786a..43eae94e4b0e 100644 --- a/net/xfrm/xfrm_ipcomp.c +++ b/net/xfrm/xfrm_ipcomp.c @@ -97,6 +97,9 @@ int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb) int err = -ENOMEM; struct ip_comp_hdr *ipch; + if (!pskb_may_pull(skb, sizeof(*ipch))) + return -EINVAL; + if (skb_linearize_cow(skb)) goto out;
If a malformed packet is received there may not be enough data to pull. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> --- net/xfrm/xfrm_ipcomp.c | 3 +++ 1 file changed, 3 insertions(+)