d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Ensure that the buffer length and the length provided in the IPv4

Browse Source 
header match when using a raw socket to send IPv4 packets and
providing the header. If they don't match, let send return -1
and set errno to EINVAL.

Before this patch is was only enforced that the length in the header
is not larger then the buffer length.

PR:			212283
Reviewed by:		ae, gnn
MFC after:		1 week
Differential Revision:	https://reviews.freebsd.org/D9161
This commit is contained in:
Michael Tuexen 2017-01-13 10:55:26 +00:00
parent 4902e14dc8
commit 24209f0122
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=312063
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
sys/netinet/raw_ip.c
View File

@ -508,7 +508,7 @@ rip_output(struct mbuf *m, struct socket *so, ...)
* and don't allow packet length sizes that will crash.
*/
if (((ip->ip_hl != (sizeof (*ip) >> 2)) && inp->inp_options)
|| (ntohs(ip->ip_len) > m->m_pkthdr.len)
|| (ntohs(ip->ip_len) != m->m_pkthdr.len)
|| (ntohs(ip->ip_len) < (ip->ip_hl << 2))) {
INP_RUNLOCK(inp);
m_freem(m);