Ensure that the buffer length and the length provided in the IPv4
header match when using a raw socket to send IPv4 packets and providing the header. If they don't match, let send return -1 and set errno to EINVAL. Before this patch is was only enforced that the length in the header is not larger then the buffer length. PR: 212283 Reviewed by: ae, gnn MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D9161
This commit is contained in:
parent
4902e14dc8
commit
24209f0122
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=312063
@ -508,7 +508,7 @@ rip_output(struct mbuf *m, struct socket *so, ...)
|
||||
* and don't allow packet length sizes that will crash.
|
||||
*/
|
||||
if (((ip->ip_hl != (sizeof (*ip) >> 2)) && inp->inp_options)
|
||||
|| (ntohs(ip->ip_len) > m->m_pkthdr.len)
|
||||
|| (ntohs(ip->ip_len) != m->m_pkthdr.len)
|
||||
|| (ntohs(ip->ip_len) < (ip->ip_hl << 2))) {
|
||||
INP_RUNLOCK(inp);
|
||||
m_freem(m);
|
||||
|
Loading…
Reference in New Issue
Block a user