x25: Handle undersized/fragmented skbs

[deliverable/linux.git] / net / x25 / x25_facilities.c

diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index f77e4e75f914b3a164e55ebf549ad32ec09f9b9c..36384a1fa9f28a3316dd28079b2bc04fce25a0fa 100644 (file)
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -44,7 +44,7 @@
 int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                struct x25_dte_facilities *dte_facs, unsigned long *vc_fac_mask)
 {
-       unsigned char *p = skb->data;
+       unsigned char *p;
        unsigned int len;
 
        *vc_fac_mask = 0;
@@ -60,14 +60,16 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
        memset(dte_facs->called_ae, '\0', sizeof(dte_facs->called_ae));
        memset(dte_facs->calling_ae, '\0', sizeof(dte_facs->calling_ae));
 
-       if (skb->len < 1)
+       if (!pskb_may_pull(skb, 1))
                return 0;
 
-       len = *p++;
+       len = skb->data[0];
 
-       if (len >= skb->len)
+       if (!pskb_may_pull(skb, 1 + len))
                return -1;
 
+       p = skb->data + 1;
+
        while (len > 0) {
                switch (*p & X25_FAC_CLASS_MASK) {
                case X25_FAC_CLASS_A: