d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add boundary checks against IP options.

Browse Source 
Obtained from:	OpenBSD
This commit is contained in:
Jonathan Lemon 2000-06-02 20:18:38 +00:00
parent 11b96475f7
commit 707d00a304
3 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/netinet/ip_icmp.c
View File

@ -654,8 +654,11 @@ icmp_reflect(m)
if (opt == IPOPT_NOP)
len = 1;
else {
if (cnt < IPOPT_OLEN + sizeof(*cp))
break;
len = cp[IPOPT_OLEN];
if (len <= 0 || len > cnt)
if (len < IPOPT_OLEN + sizeof(*cp) ||
len > cnt)
break;
}
/*

6
sys/netinet/ip_input.c
View File

@ -1083,7 +1083,7 @@ ip_dooptions(m)
goto bad;
}
optlen = cp[IPOPT_OLEN];
if (optlen <= 0 || optlen > cnt) {
if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt) {
code = &cp[IPOPT_OLEN] - (u_char *)ip;
goto bad;
}
@ -1189,6 +1189,10 @@ nosourcerouting:
break;
case IPOPT_RR:
if (optlen < IPOPT_OFFSET + sizeof(*cp)) {
code = &cp[IPOPT_OFFSET] - (u_char *)ip;
goto bad;
}
if ((off = cp[IPOPT_OFFSET]) < IPOPT_MINOFF) {
code = &cp[IPOPT_OFFSET] - (u_char *)ip;
goto bad;

4
sys/netinet/ip_output.c
View File

@ -1382,8 +1382,10 @@ ip_pcbopts(optname, pcbopt, m)
if (opt == IPOPT_NOP)
optlen = 1;
else {
if (cnt < IPOPT_OLEN + sizeof(*cp))
goto bad;
optlen = cp[IPOPT_OLEN];
if (optlen <= IPOPT_OLEN || optlen > cnt)
if (optlen < IPOPT_OLEN + sizeof(*cp) || optlen > cnt)
goto bad;
}
switch (opt) {