X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=net%2Fipv6%2Fdatagram.c;h=410046a8cc915f5ea2f56a4c7b6c105f58d1903d;hb=e5a4a72d4f88f4389e9340d383ca67031d1b8536;hp=8cdb6b65ee96bb499a7231c2f2972d2e16db4312;hpb=030352a9c7715780b2c01033ae9afe56249bb7cc;p=linux-2.6

diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 8cdb6b65ee..410046a8cc 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -703,6 +703,11 @@ int datagram_send_ctl(struct net *net,
 			}
 
 			*hlimit = *(int *)CMSG_DATA(cmsg);
+			if (*hlimit < -1 || *hlimit > 0xff) {
+				err = -EINVAL;
+				goto exit_f;
+			}
+
 			break;
 
 		case IPV6_TCLASS:
@@ -727,7 +732,7 @@ int datagram_send_ctl(struct net *net,
 			LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
 				       cmsg->cmsg_type);
 			err = -EINVAL;
-			break;
+			goto exit_f;
 		}
 	}