Commit 11604721 authored by David S. Miller's avatar David S. Miller

ipv4: Fix crashes in ip_options_compile().

The spec_dst uses should be guarded by skb_rtable() being non-NULL
not just the SKB being non-null.
Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e87183c2
......@@ -253,11 +253,14 @@ int ip_options_compile(struct net *net,
{
__be32 spec_dst = (__force __be32) 0;
unsigned char *pp_ptr = NULL;
struct rtable *rt = NULL;
unsigned char *optptr;
unsigned char *iph;
int optlen, l;
if (skb != NULL) {
rt = skb_rtable(skb);
if (rt)
spec_dst = fib_compute_spec_dst(skb);
optptr = (unsigned char *)&(ip_hdr(skb)[1]);
} else
......@@ -330,7 +333,7 @@ int ip_options_compile(struct net *net,
pp_ptr = optptr + 2;
goto error;
}
if (skb) {
if (rt) {
memcpy(&optptr[optptr[2]-1], &spec_dst, 4);
opt->is_changed = 1;
}
......@@ -372,7 +375,7 @@ int ip_options_compile(struct net *net,
goto error;
}
opt->ts = optptr - iph;
if (skb) {
if (rt) {
memcpy(&optptr[optptr[2]-1], &spec_dst, 4);
timeptr = &optptr[optptr[2]+3];
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment