[IPV4] raw: Strengthen check on validity of iph->ihl
authorHerbert Xu <herbert@gondor.apana.org.au>
Tue, 15 Jan 2008 23:21:00 +0000 (01:21 +0200)
committerAdrian Bunk <bunk@kernel.org>
Tue, 15 Jan 2008 23:21:00 +0000 (01:21 +0200)
commitd97b07efe475fc99271820c8c45db3092c99774d
tree05852ebf3e079ee0f07dfb6ef9fa87e68c00141b
parentf9fdf12742cdc18ca30ff6c3bec3bf1748deffa7
[IPV4] raw: Strengthen check on validity of iph->ihl

[ Upstream commit: f844c74fe07321953e2dd227fe35280075f18f60 ]

We currently check that iph->ihl is bounded by the real length and that
the real length is greater than the minimum IP header length.  However,
we did not check the caes where iph->ihl is less than the minimum IP
header length.

This breaks because some ip_fast_csum implementations assume that which
is quite reasonable.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
net/ipv4/raw.c