ipv6: Check the hop limit setting in ancillary data.

When specifing the outgoing hop limit as ancillary data for sendmsg(), the kernel doesn't check the integer hop limit value as specified in [RFC-3542] section 6.3. Signed-off-by: Shan Wei <[email protected]> Signed-off-by: YOSHIFUJI Hideaki <[email protected]>
pmladek · Jun 12, 2008 · e8766fc · e8766fc
1 parent 36e3dea
commit e8766fc
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
@@ -705,6 +705,11 @@ int datagram_send_ctl(struct net *net,
 			}
 
 			*hlimit = *(int *)CMSG_DATA(cmsg);
+			if (*hlimit < -1 || *hlimit > 0xff) {
+				err = -EINVAL;
+				goto exit_f;
+			}
+
 			break;
 
 		case IPV6_TCLASS: