ipv6: sr: fix out-of-bounds access in SRH validation
authorDavid Lebrun <david.lebrun@uclouvain.be>
Tue, 18 Apr 2017 15:59:49 +0000 (17:59 +0200)
committerDavid S. Miller <davem@davemloft.net>
Thu, 20 Apr 2017 19:40:33 +0000 (15:40 -0400)
commit2f3bb64247b5b083d05ccecad9c2e139bbfdc294
treec430df72c12b236b7ff4c18145ff8cc1850e0129
parentc1f8d0f98c3bc12393821c1bf00d8eaa0bd58bd8
ipv6: sr: fix out-of-bounds access in SRH validation

This patch fixes an out-of-bounds access in seg6_validate_srh() when the
trailing data is less than sizeof(struct sr6_tlv).

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David Lebrun <david.lebrun@uclouvain.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/seg6.c