Merge branches 'core/debug', 'core/futexes', 'core/locking', 'core/rcu', 'core/signal...

[linux-2.6-block.git] / net / ipv6 / datagram.c

diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 410046a8cc915f5ea2f56a4c7b6c105f58d1903d..e44deb8d4df28c54cfd90392c63647fc88b591fc 100644 (file)
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -661,6 +661,11 @@ int datagram_send_ctl(struct net *net,
                        switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                        case IPV6_SRCRT_TYPE_2:
+                               if (rthdr->hdrlen != 2 ||
+                                   rthdr->segments_left != 1) {
+                                       err = -EINVAL;
+                                       goto exit_f;
+                               }
                                break;
 #endif
                        default: