===== include/linux/socket.h 1.12 vs edited =====
--- 1.12/include/linux/socket.h	2004-09-09 06:40:01 +10:00
+++ edited/include/linux/socket.h	2004-11-27 11:53:40 +11:00
@@ -90,6 +90,10 @@
 				  (struct cmsghdr *)(ctl) : \
 				  (struct cmsghdr *)NULL)
 #define CMSG_FIRSTHDR(msg)	__CMSG_FIRSTHDR((msg)->msg_control, (msg)->msg_controllen)
+#define CMSG_OK(mhdr, cmsg) ((cmsg)->cmsg_len >= sizeof(struct cmsghdr) && \
+			     (cmsg)->cmsg_len <= (unsigned long) \
+			     ((mhdr)->msg_controllen - \
+			      ((char *)(cmsg) - (char *)(mhdr)->msg_control)))
 
 /*
  *	This mess will go away with glibc
===== net/core/scm.c 1.10 vs edited =====
--- 1.10/net/core/scm.c	2004-05-31 05:08:14 +10:00
+++ edited/net/core/scm.c	2004-11-27 11:48:55 +11:00
@@ -127,9 +127,7 @@
 		   for too short ancillary data object at all! Oops.
 		   OK, let's add it...
 		 */
-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
-				    + cmsg->cmsg_len) > msg->msg_controllen)
+		if (!CMSG_OK(msg, cmsg))
 			goto error;
 
 		if (cmsg->cmsg_level != SOL_SOCKET)
===== net/ipv4/ip_sockglue.c 1.26 vs edited =====
--- 1.26/net/ipv4/ip_sockglue.c	2004-07-01 06:10:53 +10:00
+++ edited/net/ipv4/ip_sockglue.c	2004-11-27 11:49:45 +11:00
@@ -146,11 +146,8 @@
 	struct cmsghdr *cmsg;
 
 	for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
-				    + cmsg->cmsg_len) > msg->msg_controllen) {
+		if (!CMSG_OK(msg, cmsg))
 			return -EINVAL;
-		}
 		if (cmsg->cmsg_level != SOL_IP)
 			continue;
 		switch (cmsg->cmsg_type) {
===== net/ipv6/datagram.c 1.20 vs edited =====
--- 1.20/net/ipv6/datagram.c	2004-11-10 17:57:03 +11:00
+++ edited/net/ipv6/datagram.c	2004-11-27 11:51:15 +11:00
@@ -427,9 +427,7 @@
 		int addr_type;
 		struct net_device *dev = NULL;
 
-		if (cmsg->cmsg_len < sizeof(struct cmsghdr) ||
-		    (unsigned long)(((char*)cmsg - (char*)msg->msg_control)
-				    + cmsg->cmsg_len) > msg->msg_controllen) {
+		if (!CMSG_OK(msg, cmsg)) {
 			err = -EINVAL;
 			goto exit_f;
 		}