ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt()

[sfrench/cifs-2.6.git] / net / ipv6 / output_core.c

diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index abb2c307fbe8337ce1714e7392072c945ed5af51..a338bbc33cf3cd895fa77e137d6f6389e9a6519c 100644 (file)
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -86,7 +86,6 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
        while (offset <= packet_len) {
                struct ipv6_opt_hdr *exthdr;
-               unsigned int len;
 
                switch (**nexthdr) {
 
@@ -112,10 +111,9 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
                exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
                                                 offset);
-               len = ipv6_optlen(exthdr);
-               if (len + offset >= IPV6_MAXPLEN)
+               offset += ipv6_optlen(exthdr);
+               if (offset > IPV6_MAXPLEN)
                        return -EINVAL;
-               offset += len;
                *nexthdr = &exthdr->nexthdr;
        }