Commit 39a3f234 authored by Herbert Xu's avatar Herbert Xu
Browse files

xfrm: ipcomp: Call pskb_may_pull in ipcomp_input 



If a malformed packet is received there may not be enough data
to pull.  This isn't a problem in practice because the caller
has already done xfrm_parse_spi which in effect does the same
thing.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Acked-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 9b00eb92

net/xfrm/xfrm_ipcomp.c

+3 −0
Original line number Diff line number Diff line
@@ -97,6 +97,9 @@ int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb) 
	int err = -ENOMEM;

	struct ip_comp_hdr *ipch;



	if (!pskb_may_pull(skb, sizeof(*ipch)))

		return -EINVAL;



	if (skb_linearize_cow(skb))

		goto out;