Commit 9c396a7b authored Jun 04, 2008 by Allan Stephens Committed by David S. Miller Jun 04, 2008

tipc: Prevent access of non-existent field in short message header

This patch eliminates a case where TIPC's link code could try reading
a field that is not present in a short message header. (The random
value obtained was not being used, but the read operation could result
in an invalid memory access exception in extremely rare circumstances.)

Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 1265a021

net/tipc/link.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -2674,10 +2674,12 @@ int tipc_link_send_long_buf(struct link l_ptr, struct sk_buff buf)
		u32 pack_sz = link_max_pkt(l_ptr);
		u32 fragm_sz = pack_sz - INT_H_SIZE;
		u32 fragm_no = 1;
		u32 destaddr = msg_destnode(inmsg);
		u32 destaddr;

		if (msg_short(inmsg))
		destaddr = l_ptr->addr;
		else
		destaddr = msg_destnode(inmsg);

		if (msg_routed(inmsg))
		msg_set_prevnode(inmsg, tipc_own_addr);

Admin message