diff options
| author | ume <ume@FreeBSD.org> | 2007-01-16 15:55:29 +0000 |
|---|---|---|
| committer | ume <ume@FreeBSD.org> | 2007-01-16 15:55:29 +0000 |
| commit | 66ac91ed3b72b4195a44516c9cefc590a4d199a9 (patch) | |
| tree | 17840d3427ece06c7424f6a4972edb6642c31165 | |
| parent | 39f3fe7daf5b4cec90afbe413b53ae5f77acad42 (diff) | |
| download | FreeBSD-src-66ac91ed3b72b4195a44516c9cefc590a4d199a9.zip FreeBSD-src-66ac91ed3b72b4195a44516c9cefc590a4d199a9.tar.gz | |
Avoid infinite loop if nicmp6 and nip6 are not on the same mbuf.
NetBSD PR 34994+35333
MFC after: 3 days
| -rw-r--r-- | sys/netinet6/icmp6.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c index 9ab0741..d2cb1b7 100644 --- a/sys/netinet6/icmp6.c +++ b/sys/netinet6/icmp6.c @@ -588,7 +588,8 @@ icmp6_input(mp, offp, proto) n->m_next = n0; } else { nip6 = mtod(n, struct ip6_hdr *); - nicmp6 = (struct icmp6_hdr *)((caddr_t)nip6 + off); + IP6_EXTHDR_GET(nicmp6, struct icmp6_hdr *, n, off, + sizeof(*nicmp6)); noff = off; } nicmp6->icmp6_type = ICMP6_ECHO_REPLY; |
