d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix LSRR option length check: it has to be less or equal remained header's

Browse Source 
length minus sizeof(struct ip).

MFC after:	1 week
This commit is contained in:
Maxim Konovalov 2002-10-21 11:43:46 +00:00
parent acd386159a
commit 3c721ab3c9
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=105624
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sbin/ping/ping.c
View File

@ -957,7 +957,8 @@ pr_pack(buf, cc, from, tv)
j = cp[IPOPT_OLEN] - IPOPT_MINOFF + 1;
hlen -= 2;
cp += 2;
if (j >= INADDR_LEN && j <= hlen - INADDR_LEN) {
if (j >= INADDR_LEN &&
j <= hlen - (int)sizeof(struct ip)) {
for (;;) {
bcopy(++cp, &ina.s_addr, INADDR_LEN);
if (ina.s_addr == 0)