d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

be careful on mbuf overrun on ctlinput.

Browse Source 
short icmp6 packet may be able to panic the kernel.
sync with kame.
This commit is contained in:
itojun 2000-10-23 07:11:01 +00:00
parent b7dce38697
commit 4bd5d6f83f
3 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/netinet/tcp_subr.c
View File

@ -1012,6 +1012,7 @@ tcp6_ctlinput(cmd, sa, d)
} else {
m = NULL;
ip6 = NULL;
off = 0; /* fool gcc */
}
/*
@ -1036,7 +1037,11 @@ tcp6_ctlinput(cmd, sa, d)
m->m_pkthdr.rcvif != NULL)
s.s6_addr16[1] = htons(m->m_pkthdr.rcvif->if_index);
if (m->m_len < off + sizeof(*thp)) {
/* check if we can safely examine src and dst ports */
if (m->m_pkthdr.len < off + sizeof(th))
return;
if (m->m_len < off + sizeof(th)) {
/*
* this should be rare case
* because now MINCLSIZE is "(MHLEN + 1)",

7
sys/netinet/tcp_timewait.c
View File

@ -1012,6 +1012,7 @@ tcp6_ctlinput(cmd, sa, d)
} else {
m = NULL;
ip6 = NULL;
off = 0; /* fool gcc */
}
/*
@ -1036,7 +1037,11 @@ tcp6_ctlinput(cmd, sa, d)
m->m_pkthdr.rcvif != NULL)
s.s6_addr16[1] = htons(m->m_pkthdr.rcvif->if_index);
if (m->m_len < off + sizeof(*thp)) {
/* check if we can safely examine src and dst ports */
if (m->m_pkthdr.len < off + sizeof(th))
return;
if (m->m_len < off + sizeof(th)) {
/*
* this should be rare case
* because now MINCLSIZE is "(MHLEN + 1)",

6
sys/netinet6/udp6_usrreq.c
View File

@ -1,5 +1,5 @@
/* $FreeBSD$ */
/* $KAME: udp6_usrreq.c,v 1.11 2000/06/18 06:23:06 jinmei Exp $ */
/* $KAME: udp6_usrreq.c,v 1.17 2000/10/13 17:46:21 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@ -450,6 +450,10 @@ udp6_ctlinput(cmd, sa, d)
if (IN6_IS_ADDR_LINKLOCAL(&s))
s.s6_addr16[1] = htons(m->m_pkthdr.rcvif->if_index);
/* check if we can safely examine src and dst ports */
if (m->m_pkthdr.len < off + sizeof(uh))
return;
if (m->m_len < off + sizeof(uh)) {
/*
* this should be rare case,