1 files changed, 42 insertions, 0 deletions
diff --git a/trunk/2.6.18/debian-security-patches/ipv6_getsockopt_sticky-null-opt.patch b/trunk/2.6.18/debian-security-patches/ipv6_getsockopt_sticky-null-opt.patch
new file mode 100644
index 0000000..1a124c2
--- /dev/null
+++ b/trunk/2.6.18/debian-security-patches/ipv6_getsockopt_sticky-null-opt.patch
@@ -0,0 +1,42 @@
+From: David S. Miller <davem@sunset.davemloft.net>
+Date: Wed, 7 Mar 2007 20:50:46 +0000 (-0800)
+Subject: [IPV6]: Handle np->opt being NULL in ipv6_getsockopt_sticky().
+X-Git-Tag: v2.6.21-rc4~99^2~7
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=286930797d74b2c9a5beae84836044f6a836235f
+
+[IPV6]: Handle np->opt being NULL in ipv6_getsockopt_sticky().
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index 286c867..4e0561a 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -795,11 +795,15 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ EXPORT_SYMBOL(compat_ipv6_setsockopt);
+ #endif
+ 
+-static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
++static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
+ 				  char __user *optval, int len)
+ {
+-	if (!hdr)
++	struct ipv6_opt_hdr *hdr;
++
++	if (!opt || !opt->hopopt)
+ 		return 0;
++	hdr = opt->hopopt;
++
+ 	len = min_t(int, len, ipv6_optlen(hdr));
+ 	if (copy_to_user(optval, hdr, ipv6_optlen(hdr)))
+ 		return -EFAULT;
+@@ -940,7 +944,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
+ 	{
+ 
+ 		lock_sock(sk);
+-		len = ipv6_getsockopt_sticky(sk, np->opt->hopopt,
++		len = ipv6_getsockopt_sticky(sk, np->opt,
+ 					     optval, len);
+ 		release_sock(sk);
+ 		return put_user(len, optlen);