Commit 9c396a7b authored by Allan Stephens's avatar Allan Stephens Committed by David S. Miller

tipc: Prevent access of non-existent field in short message header

This patch eliminates a case where TIPC's link code could try reading
a field that is not present in a short message header.  (The random
value obtained was not being used, but the read operation could result
in an invalid memory access exception in extremely rare circumstances.)
Signed-off-by: default avatarAllan Stephens <allan.stephens@windriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1265a021
...@@ -2674,10 +2674,12 @@ int tipc_link_send_long_buf(struct link *l_ptr, struct sk_buff *buf) ...@@ -2674,10 +2674,12 @@ int tipc_link_send_long_buf(struct link *l_ptr, struct sk_buff *buf)
u32 pack_sz = link_max_pkt(l_ptr); u32 pack_sz = link_max_pkt(l_ptr);
u32 fragm_sz = pack_sz - INT_H_SIZE; u32 fragm_sz = pack_sz - INT_H_SIZE;
u32 fragm_no = 1; u32 fragm_no = 1;
u32 destaddr = msg_destnode(inmsg); u32 destaddr;
if (msg_short(inmsg)) if (msg_short(inmsg))
destaddr = l_ptr->addr; destaddr = l_ptr->addr;
else
destaddr = msg_destnode(inmsg);
if (msg_routed(inmsg)) if (msg_routed(inmsg))
msg_set_prevnode(inmsg, tipc_own_addr); msg_set_prevnode(inmsg, tipc_own_addr);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment