Fix a bunch of off-by-one errors in the range checking code.
This commit is contained in:
parent
0c7721e8f9
commit
78f94aa951
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=119995
@ -129,7 +129,7 @@ raw_ctlinput(cmd, arg, dummy)
|
||||
void *dummy;
|
||||
{
|
||||
|
||||
if (cmd < 0 || cmd > PRC_NCMDS)
|
||||
if (cmd < 0 || cmd >= PRC_NCMDS)
|
||||
return;
|
||||
/* INCOMPLETE */
|
||||
}
|
||||
|
@ -1138,7 +1138,7 @@ tcp_ctlinput(cmd, sa, vip)
|
||||
notify = in_rtchange;
|
||||
} else if (cmd == PRC_HOSTDEAD)
|
||||
ip = 0;
|
||||
else if ((unsigned)cmd > PRC_NCMDS || inetctlerrmap[cmd] == 0)
|
||||
else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0)
|
||||
return;
|
||||
if (ip) {
|
||||
s = splnet();
|
||||
@ -1204,7 +1204,7 @@ tcp6_ctlinput(cmd, sa, d)
|
||||
else if (cmd == PRC_MSGSIZE)
|
||||
notify = tcp_mtudisc;
|
||||
else if (!PRC_IS_REDIRECT(cmd) &&
|
||||
((unsigned)cmd > PRC_NCMDS || inet6ctlerrmap[cmd] == 0))
|
||||
((unsigned)cmd >= PRC_NCMDS || inet6ctlerrmap[cmd] == 0))
|
||||
return;
|
||||
|
||||
/* if the parameter is from icmp6, decode it. */
|
||||
|
@ -1138,7 +1138,7 @@ tcp_ctlinput(cmd, sa, vip)
|
||||
notify = in_rtchange;
|
||||
} else if (cmd == PRC_HOSTDEAD)
|
||||
ip = 0;
|
||||
else if ((unsigned)cmd > PRC_NCMDS || inetctlerrmap[cmd] == 0)
|
||||
else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0)
|
||||
return;
|
||||
if (ip) {
|
||||
s = splnet();
|
||||
@ -1204,7 +1204,7 @@ tcp6_ctlinput(cmd, sa, d)
|
||||
else if (cmd == PRC_MSGSIZE)
|
||||
notify = tcp_mtudisc;
|
||||
else if (!PRC_IS_REDIRECT(cmd) &&
|
||||
((unsigned)cmd > PRC_NCMDS || inet6ctlerrmap[cmd] == 0))
|
||||
((unsigned)cmd >= PRC_NCMDS || inet6ctlerrmap[cmd] == 0))
|
||||
return;
|
||||
|
||||
/* if the parameter is from icmp6, decode it. */
|
||||
|
@ -824,7 +824,7 @@ in6_pcbnotify(head, dst, fport_arg, src, lport_arg, cmd, notify)
|
||||
u_int32_t flowinfo;
|
||||
int errno, s;
|
||||
|
||||
if ((unsigned)cmd > PRC_NCMDS || dst->sa_family != AF_INET6)
|
||||
if ((unsigned)cmd >= PRC_NCMDS || dst->sa_family != AF_INET6)
|
||||
return;
|
||||
|
||||
sa6_dst = (struct sockaddr_in6 *)dst;
|
||||
|
@ -279,7 +279,7 @@ ipx_ctlinput(cmd, arg_as_sa, dummy)
|
||||
caddr_t arg = (/* XXX */ caddr_t)arg_as_sa;
|
||||
struct ipx_addr *ipx;
|
||||
|
||||
if (cmd < 0 || cmd > PRC_NCMDS)
|
||||
if (cmd < 0 || cmd >= PRC_NCMDS)
|
||||
return;
|
||||
switch (cmd) {
|
||||
struct sockaddr_ipx *sipx;
|
||||
|
@ -638,7 +638,7 @@ spx_ctlinput(cmd, arg_as_sa, dummy)
|
||||
struct ipx_addr *na;
|
||||
struct sockaddr_ipx *sipx;
|
||||
|
||||
if (cmd < 0 || cmd > PRC_NCMDS)
|
||||
if (cmd < 0 || cmd >= PRC_NCMDS)
|
||||
return;
|
||||
|
||||
switch (cmd) {
|
||||
|
Loading…
Reference in New Issue
Block a user