By default next_cmd() initializes only first u32 of opcode. O_ICMP6TYPE opcode has array of bit masks to store corresponding ICMPv6 types. An opcode that precedes O_ICMP6TYPE, e.g. O_IP6_DST, can have variable length and during opcode filling it can modify memory that will be used by O_ICMP6TYPE opcode. Without explicit initialization this leads to creation of wrong opcode. Reported by: Boris N. Lytochkin Obtained from: Yandex LLC MFC after: 3 days |
||
---|---|---|
.. | ||
altq.c | ||
dummynet.c | ||
ipfw2.c | ||
ipfw2.h | ||
ipfw.8 | ||
ipv6.c | ||
main.c | ||
Makefile | ||
Makefile.depend | ||
nat64clat.c | ||
nat64lsn.c | ||
nat64stl.c | ||
nat.c | ||
nptv6.c | ||
tables.c |