| .. | .. |
|---|
| 243 | 243 | int err; |
|---|
| 244 | 244 | struct net *net = dev_net(skb->dev); |
|---|
| 245 | 245 | |
|---|
| 246 | | - /* Only need dccph_dport & dccph_sport which are the first |
|---|
| 247 | | - * 4 bytes in dccp header. |
|---|
| 248 | | - * Our caller (icmp_socket_deliver()) already pulled 8 bytes for us. |
|---|
| 249 | | - */ |
|---|
| 250 | | - BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8); |
|---|
| 251 | | - BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8); |
|---|
| 246 | + if (!pskb_may_pull(skb, offset + sizeof(*dh))) |
|---|
| 247 | + return -EINVAL; |
|---|
| 248 | + dh = (struct dccp_hdr *)(skb->data + offset); |
|---|
| 249 | + if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh))) |
|---|
| 250 | + return -EINVAL; |
|---|
| 251 | + iph = (struct iphdr *)skb->data; |
|---|
| 252 | 252 | dh = (struct dccp_hdr *)(skb->data + offset); |
|---|
| 253 | 253 | |
|---|
| 254 | 254 | sk = __inet_lookup_established(net, &dccp_hashinfo, |
|---|