d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix LSRR option length check: it has to be less or equal remained header's

Browse Source 
length minus sizeof(struct ip).

MFC after:	1 week
This commit is contained in:
maxim 2002-10-21 11:43:46 +00:00
parent e48632f546
commit d997104201
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sbin/ping/ping.c
View File

@ -957,7 +957,8 @@ pr_pack(buf, cc, from, tv)
j = cp[IPOPT_OLEN] - IPOPT_MINOFF + 1;
hlen -= 2;
cp += 2;
if (j >= INADDR_LEN && j <= hlen - INADDR_LEN) {
if (j >= INADDR_LEN &&
j <= hlen - (int)sizeof(struct ip)) {
for (;;) {
bcopy(++cp, &ina.s_addr, INADDR_LEN);
if (ina.s_addr == 0)