sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb

[linux-block.git] / net / sctp / input.c

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 5ef86fdb11769d9c8a32219c5c7361fc34217b02..1f1786021d9c81fb0ebd27b027fc479faf1e72f5 100644 (file)
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -702,7 +702,7 @@ static int sctp_rcv_ootb(struct sk_buff *skb)
                ch = skb_header_pointer(skb, offset, sizeof(*ch), &_ch);
 
                /* Break out if chunk length is less then minimal. */
-               if (ntohs(ch->length) < sizeof(_ch))
+               if (!ch || ntohs(ch->length) < sizeof(_ch))
                        break;
 
                ch_end = offset + SCTP_PAD4(ntohs(ch->length));