net: ipv6: router advertisement message length should be within limits

[thirdparty/u-boot.git] / net / ndisc.c

diff --git a/net/ndisc.c b/net/ndisc.c
index 0b27779ce5ac060d19366a83a1c57cc133cc62bb..d1cec0601c83ea10961f50bcc344399e0a3caa3b 100644 (file)
--- a/net/ndisc.c
+++ b/net/ndisc.c
@@ -382,6 +382,8 @@ int process_ra(struct ip6_hdr *ip6, int len)
        unsigned char type = 0;
        struct icmp6_ra_prefix_info *prefix = NULL;
 
+       if (len > ETH_MAX_MTU)
+               return -EMSGSIZE;
        /* Ignore the packet if router lifetime is 0. */
        if (!icmp->icmp6_rt_lifetime)
                return -EOPNOTSUPP;