[UDP]: Fix length check. (3be550f3) · Commits · 戴 / test

Rémi Denis-Courmont wrote: > Right. By the way, shouldn't "len" rather be signed in there? > > unsigned int len; > > /* if we're overly short, let UDP handle it */ > len = skb->len - sizeof(struct udphdr); > if (len <= 0) > goto udp; It should, but the < 0 case can't happen since __udp4_lib_rcv already makes sure that we have at least a complete UDP header. Anyways, this patch fixes it. Signed-off-by:

Patrick McHardy <kaber@trash.net> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/udp.c

+2 −7

Original line number	Diff line number	Diff line
		@@ -951,14 +951,10 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
		* >0 if skb should be passed on to UDP.
		* <0 if skb should be resubmitted as proto -N
		*/
		unsigned int len;

		/* if we're overly short, let UDP handle it */
		len = skb->len - sizeof(struct udphdr);
		if (len <= 0)
		goto udp;

		if (up->encap_rcv != NULL) {
		if (skb->len > sizeof(struct udphdr) &&
		up->encap_rcv != NULL) {
		int ret;

		ret = (*up->encap_rcv)(sk, skb);
		@@ -971,7 +967,6 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
		/* FALLTHROUGH -- it's a UDP Packet */
		}

		udp:
		/*
		* UDP-Lite specific tests, ignored on UDP sockets
		*/

Admin message