From c3069b3a2b39f280c189dfe1c95cb1b9e8f1c5f2 Mon Sep 17 00:00:00 2001 From: Ville Nuorvala Date: Mon, 17 Nov 2003 02:56:12 -0800 Subject: [PATCH] [IPV6]: Verify nlmsg_len in rt6_dump_route(). --- net/ipv6/route.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 6711d91692737..4c5e714a7da7f 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1558,13 +1558,13 @@ rtattr_failure: static int rt6_dump_route(struct rt6_info *rt, void *p_arg) { struct rt6_rtnl_dump_arg *arg = (struct rt6_rtnl_dump_arg *) p_arg; - struct rtmsg *rtm; int prefix; - rtm = NLMSG_DATA(arg->cb->nlh); - if (rtm) + if (arg->cb->nlh->nlmsg_len >= NLMSG_LENGTH(sizeof(struct rtmsg))) { + struct rtmsg *rtm = NLMSG_DATA(arg->cb->nlh); prefix = (rtm->rtm_flags & RTM_F_PREFIX) != 0; - else prefix = 0; + } else + prefix = 0; return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE, NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq, -- 2.53.0