From: Lennart Poettering <lennart@poettering.net>
Date: Mon, 26 Nov 2018 21:12:07 +0000 (+0100)
Subject: sd-radv: when receiving a too short packet, make sure we dequeue it
X-Git-Tag: v240~210^2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cfffddeac504190914dc41f7fe5c7cb42bdc1ea6;p=thirdparty%2Fsystemd.git

sd-radv: when receiving a too short packet, make sure we dequeue it
---

diff --git a/src/libsystemd-network/sd-radv.c b/src/libsystemd-network/sd-radv.c
index f256cbc984c..7b51f28ff23 100644
--- a/src/libsystemd-network/sd-radv.c
+++ b/src/libsystemd-network/sd-radv.c
@@ -229,9 +229,8 @@ static int radv_recv(sd_event_source *s, int fd, uint32_t revents, void *userdat
         assert(ra->event);
 
         buflen = next_datagram_size_fd(fd);
-
-        if ((unsigned) buflen < sizeof(struct nd_router_solicit))
-                return log_radv("Too short packet received");
+        if (buflen < 0)
+                return (int) buflen;
 
         buf = new0(char, buflen);
         if (!buf)
@@ -264,6 +263,11 @@ static int radv_recv(sd_event_source *s, int fd, uint32_t revents, void *userdat
                 return 0;
         }
 
+        if ((size_t) buflen < sizeof(struct nd_router_solicit)) {
+                log_radv("Too short packet received");
+                return 0;
+        }
+
         (void) in_addr_to_string(AF_INET6, (union in_addr_union*) &src, &addr);
 
         r = radv_send(ra, &src, ra->lifetime);