diff options
| author | Sabrina Dubroca <sd@queasysnail.net> | 2017-07-19 22:28:55 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-08-11 09:08:52 -0700 |
| commit | f09db7559c1faf6f7c2128a92050b978a480681c (patch) | |
| tree | 07cc3f7deae03246c54e69c24771263bb9f5c4b0 /include/linux/debugobjects.h | |
| parent | e9b2f4617a4e631eae1717a6264cbb3e405f377f (diff) | |
ipv6: avoid overflow of offset in ip6_find_1stfragopt
[ Upstream commit 6399f1fae4ec29fab5ec76070435555e256ca3a6 ]
In some cases, offset can overflow and can cause an infinite loop in
ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and
cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.
This problem has been here since before the beginning of git history.
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/linux/debugobjects.h')
0 files changed, 0 insertions, 0 deletions