patch-2.2.10 linux/net/ipv6/tcp_ipv6.c

• Lines: 37
• Date: Wed Jun 2 09:55:22 1999
• Orig file: v2.2.9/linux/net/ipv6/tcp_ipv6.c
• Orig date: Wed Apr 28 11:37:32 1999

diff -u --recursive --new-file v2.2.9/linux/net/ipv6/tcp_ipv6.c linux/net/ipv6/tcp_ipv6.c
@@ -5,7 +5,7 @@
  *	Authors:
  *	Pedro Roque		<roque@di.fc.ul.pt>	
  *
- *	$Id: tcp_ipv6.c,v 1.104 1999/04/24 00:27:25 davem Exp $
+ *	$Id: tcp_ipv6.c,v 1.104.2.2 1999/06/02 04:06:27 davem Exp $
  *
  *	Based on: 
  *	linux/net/ipv4/tcp.c
@@ -551,7 +551,7 @@
 
 failure:
 	dst_release(xchg(&sk->dst_cache, NULL));
-	memcpy(&np->daddr, 0, sizeof(struct in6_addr));
+	memset(&np->daddr, 0, sizeof(struct in6_addr));
 	sk->daddr = 0;
 	return err;
 }
@@ -1362,6 +1362,7 @@
 
 	tcp_statistics.TcpInSegs++;
 
+	len = skb->len;
 	if (len < sizeof(struct tcphdr))
 		goto bad_packet;
 
@@ -1382,6 +1383,10 @@
 	default:
 		/* CHECKSUM_UNNECESSARY */
 	};
+
+	if((th->doff * 4) < sizeof(struct tcphdr) ||
+	   len < (th->doff * 4))
+		goto bad_packet;
 
 	sk = __tcp_v6_lookup(th, saddr, th->source, daddr, th->dest, tcp_v6_iif(skb));