Mark Johnston 1af332a7d8 rtsold: Fix validation of RDNSS options
The header specifies the size of the option in multiples of eight bytes.
The option consists of an eight-byte header followed by one or more IPv6
addresses, so the option is invalid if the size is not equal to 1+2n for
some n>0.  Check this.

The bug can cause random stack data to be formatted as an IPv6 address
and passed to resolvconf(8), but a host able to trigger the bug may also
specify arbitrary addresses this way.

Reported by:	Q C <cq674350529@gmail.com>
Sponsored by:	The FreeBSD Foundation
MFC after:	3 days
2021-03-21 14:19:42 -04:00
..
2020-02-19 12:49:49 +00:00
2017-10-31 00:07:04 +00:00
2017-10-31 00:07:04 +00:00
2018-08-11 13:23:09 +00:00
2021-01-07 20:40:41 -07:00
2020-06-22 07:46:24 +00:00
2020-11-20 16:46:51 +00:00
2020-12-19 13:17:25 +00:00
2021-02-01 13:13:36 -08:00
2021-02-05 03:22:26 +02:00
2020-12-30 13:05:41 -05:00
2021-01-14 19:12:55 +01:00
2021-01-05 14:56:23 -05:00
2019-12-04 16:56:11 +00:00
2019-02-04 21:28:25 +00:00
2020-10-09 14:03:45 +00:00
2021-01-17 11:55:06 -08:00
2020-04-10 23:10:28 +00:00
2021-01-06 19:04:09 +01:00
2020-10-09 14:03:45 +00:00
2018-05-28 09:41:44 +00:00
2017-12-28 05:34:04 +00:00
2019-05-04 02:09:30 +00:00
2020-10-09 19:12:44 +00:00
2018-05-19 20:57:22 +00:00
2020-10-09 14:03:45 +00:00
2020-08-17 10:25:02 +00:00
2020-10-09 14:03:45 +00:00
2021-01-04 16:19:36 +01:00
2020-04-06 23:16:05 +00:00
2020-04-06 23:16:05 +00:00
2020-04-06 23:16:05 +00:00
2019-12-11 17:37:53 +00:00
2020-06-24 02:08:08 +00:00
2020-02-19 12:49:49 +00:00
2020-08-21 09:48:00 +00:00
2019-04-22 17:52:46 +00:00
2020-03-23 14:44:23 +00:00
2019-12-11 17:37:53 +00:00
2019-11-21 01:24:49 +00:00
2021-01-25 21:45:03 +00:00
2020-09-11 13:28:37 +00:00
2020-04-06 23:16:05 +00:00
2021-03-02 15:22:05 -06:00
2018-07-24 20:20:17 +00:00