diff options
| author | ume <ume@FreeBSD.org> | 2005-03-09 14:39:48 +0000 |
|---|---|---|
| committer | ume <ume@FreeBSD.org> | 2005-03-09 14:39:48 +0000 |
| commit | 6cc5b893d530f8cbf5e3f7b98d6e871693b006f2 (patch) | |
| tree | 8392cde3504275915a4b8ba475bc2bba70bc107a | |
| parent | e39ac61ec6254db072608bf4ed6ef2cd699eb119 (diff) | |
| download | FreeBSD-src-6cc5b893d530f8cbf5e3f7b98d6e871693b006f2.zip FreeBSD-src-6cc5b893d530f8cbf5e3f7b98d6e871693b006f2.tar.gz | |
reported from VANHULLEBUS Yvan [remote kernel crash may result]
Submitted by: itojun
Obtained from: KAME
MFC after: 1 day
| -rw-r--r-- | sys/netinet6/ipsec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/netinet6/ipsec.c b/sys/netinet6/ipsec.c index 960d96c..63e02d0 100644 --- a/sys/netinet6/ipsec.c +++ b/sys/netinet6/ipsec.c @@ -1007,7 +1007,7 @@ ipsec4_get_ulp(m, spidx, needport) uh.uh_dport; return; case IPPROTO_AH: - if (m->m_pkthdr.len > off + sizeof(ip6e)) + if (off + sizeof(ip6e) > m->m_pkthdr.len) return; m_copydata(m, off, sizeof(ip6e), (caddr_t)&ip6e); off += (ip6e.ip6e_len + 2) << 2; |
