From b8a36d0c630d4c447ab50cc3cc8fcb5e349265b4 Mon Sep 17 00:00:00 2001
From: glebius <glebius@FreeBSD.org>
Date: Fri, 11 Feb 2005 23:07:22 +0000
Subject: [PATCH] Do not trust ipfw: check m_len always, not only after m_dup.

Submitted by:	ru
---
 sys/netgraph/ng_ipfw.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/sys/netgraph/ng_ipfw.c b/sys/netgraph/ng_ipfw.c
index 89a0a77af0be..b4b421bf882d 100644
--- a/sys/netgraph/ng_ipfw.c
+++ b/sys/netgraph/ng_ipfw.c
@@ -294,10 +294,13 @@ ng_ipfw_input(struct mbuf **m0, int dir, struct ip_fw_args *fwa, int tee)
 		m_tag_prepend(m, &ngit->mt);
 
 	} else
-		if ((m = m_dup(*m0, M_DONTWAIT)) == NULL ||
-		    (m = m_pullup(m, sizeof(struct ip))) == NULL)
+		if ((m = m_dup(*m0, M_DONTWAIT)) == NULL)
 			return (ENOMEM);	/* which is ignored */
 
+	if (m->m_len < sizeof(struct ip) &&
+		(m = m_pullup(m, sizeof(struct ip))) == NULL)
+			return(EINVAL);
+
 	ip = mtod(m, struct ip *);
 	ip->ip_len = htons(ip->ip_len);
 	ip->ip_off = htons(ip->ip_off);