more strict sanity check for ESP tail

Obtained from: KAME
2003-10-22 10:44:59 +00:00 · 2003-10-22 10:44:59 +00:00 · d11ff9f6a5
commit d11ff9f6a5
parent 698ac71d64
1 changed files with 1 additions and 1 deletions
--- a/sys/netinet6/esp_input.c
+++ b/sys/netinet6/esp_input.c
@ -332,7 +332,7 @@ noreplaycheck:
 	taillen = esptail.esp_padlen + sizeof(esptail);

 	if (m->m_pkthdr.len < taillen ||
-	    m->m_pkthdr.len - taillen < hlen) {	/* ? */
+	    m->m_pkthdr.len - taillen < off + esplen + ivlen + sizeof(esptail)) {
 		ipseclog((LOG_WARNING,
 		    "bad pad length in IPv4 ESP input: %s %s\n",
 		    ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));