ipv6: Prevent overrun when parsing v6 header options

[pandora-kernel.git] / net / ipv6 / af_inet6.c

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 8657823..914c7d5 100644 (file)
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -825,6 +825,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, u32 features)
                                           sizeof(*ipv6h));
                if (proto == IPPROTO_UDP) {
                        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+                       if (unfrag_ip6hlen < 0)
+                               return ERR_PTR(unfrag_ip6hlen);
                        fptr = (struct frag_hdr *)(skb_network_header(skb) +
                                unfrag_ip6hlen);
                        fptr->frag_off = htons(offset);