[PATCH nf] netfilter: ip6t_ah: validate AH header length

[Zhixing Chen <running910@gmail.com>]

ip6t_ah checks that the fixed AH header is present, then uses hdrlen to
derive the advertised AH header length for matching.

Return false if the skb does not contain the advertised AH header length.
This avoids matching AH headers whose advertised length is not present in
the skb.

Signed-off-by: Zhixing Chen <running910@gmail.com>
---

I noticed ip6t_hbh and ip6t_rt already do this advertised-length check
for their IPv6 extension headers, so this keeps ip6t_ah in line with
those matches.

---
 net/ipv6/netfilter/ip6t_ah.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 70da2f2ce064..a40240125a1b 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -56,6 +56,10 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
 	}
 
 	hdrlen = ipv6_authlen(ah);
+	if (skb->len - ptr < hdrlen) {
+		/* Packet smaller than its length field */
+		return false;
+	}
 
 	pr_debug("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
 	pr_debug("RES %04X ", ah->reserved);
-- 
2.34.1