ipv6: Prevent overrun when parsing v6 header options

[pandora-kernel.git] / net / ipv6 / udp.c

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 03a7ed1..8157ae0 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1353,6 +1353,8 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
         * bytes to insert fragment header.
         */
        unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
+       if (unfrag_ip6hlen < 0)
+               return ERR_PTR(unfrag_ip6hlen);
        nexthdr = *prevhdr;
        *prevhdr = NEXTHDR_FRAGMENT;
        unfrag_len = skb_network_header(skb) - skb_mac_header(skb) +