[IPV6]: In ipv6_skip_exthdr(), access frag header correctly.

a0d49aa6 · Yasuyuki Kozakai · Stephen Hemminger · e665d185 · a0d49aa6
Commit a0d49aa6 authored Feb 19, 2004 by Yasuyuki Kozakai Committed by Stephen Hemminger Feb 19, 2004
Show whitespace changes
Inline Side-by-side

Showing with 10 additions and 2 deletions

net/ipv6/exthdrs.c net/ipv6/exthdrs.c +10 -2

No files found.
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -709,8 +709,16 @@ int ipv6_skip_exthdr(struct sk_buff *skb, int start, u8 *nexthdrp, int len)
 		if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
 			BUG();
 		if (nexthdr == NEXTHDR_FRAGMENT) {
-			struct frag_hdr *fhdr = (struct frag_hdr *) &hdr;
+			unsigned short frag_off;
-			if (ntohs(fhdr->frag_off) & ~0x7)
+			if (skb_copy_bits(skb,
+					  start+offsetof(struct frag_hdr,
+							 frag_off),
+					  &frag_off,
+					  sizeof(frag_off))) {
+				return -1;
+			}
+			if (ntohs(frag_off) & ~0x7)
 				break;
 			hdrlen = 8;
 		} else if (nexthdr == NEXTHDR_AUTH)