1af332a7d8
The header specifies the size of the option in multiples of eight bytes. The option consists of an eight-byte header followed by one or more IPv6 addresses, so the option is invalid if the size is not equal to 1+2n for some n>0. Check this. The bug can cause random stack data to be formatted as an IPv6 address and passed to resolvconf(8), but a host able to trigger the bug may also specify arbitrary addresses this way. Reported by: Q C <cq674350529@gmail.com> Sponsored by: The FreeBSD Foundation MFC after: 3 days |
||
|---|---|---|
| .. | ||
| cap_llflags.c | ||
| cap_script.c | ||
| cap_sendmsg.c | ||
| dump.c | ||
| if.c | ||
| Makefile | ||
| Makefile.depend | ||
| Makefile.depend.options | ||
| rtsock.c | ||
| rtsol.c | ||
| rtsold.8 | ||
| rtsold.c | ||
| rtsold.h | ||