diff options
| author | Allan Stephens <allan.stephens@windriver.com> | 2008-06-04 17:48:25 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-06-04 17:48:25 -0700 |
| commit | 99c145939bc1f65f9b946f2b9dd7bfc1f44783d6 (patch) | |
| tree | 734a1f0c4a5ca0075087aa3a9f74635b04a1ab34 /net/tipc | |
| parent | 9bef54383d16568da19cfe46bdc52cdedb9bb8da (diff) | |
| download | linux-99c145939bc1f65f9b946f2b9dd7bfc1f44783d6.tar.gz linux-99c145939bc1f65f9b946f2b9dd7bfc1f44783d6.tar.bz2 linux-99c145939bc1f65f9b946f2b9dd7bfc1f44783d6.zip | |
tipc: Fix bugs in rejection of message with short header
This patch ensures that TIPC doesn't try to access non-existent
message header fields when rejecting a message with a short header.
Signed-off-by: Allan Stephens <allan.stephens@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc')
| -rw-r--r-- | net/tipc/port.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/net/tipc/port.c b/net/tipc/port.c index 93014f9bc95f..2e0cff408ff9 100644 --- a/net/tipc/port.c +++ b/net/tipc/port.c @@ -448,13 +448,15 @@ int tipc_reject_msg(struct sk_buff *buf, u32 err) msg_set_errcode(rmsg, err); msg_set_destport(rmsg, msg_origport(msg)); msg_set_origport(rmsg, msg_destport(msg)); - if (msg_short(msg)) + if (msg_short(msg)) { msg_set_orignode(rmsg, tipc_own_addr); - else + /* leave name type & instance as zeroes */ + } else { msg_set_orignode(rmsg, msg_destnode(msg)); + msg_set_nametype(rmsg, msg_nametype(msg)); + msg_set_nameinst(rmsg, msg_nameinst(msg)); + } msg_set_size(rmsg, data_sz + hdr_sz); - msg_set_nametype(rmsg, msg_nametype(msg)); - msg_set_nameinst(rmsg, msg_nameinst(msg)); skb_copy_to_linear_data_offset(rbuf, hdr_sz, msg_data(msg), data_sz); /* send self-abort message when rejecting on a connected port */ |