diff options
| author | ume <ume@FreeBSD.org> | 2005-07-19 18:09:44 +0000 |
|---|---|---|
| committer | ume <ume@FreeBSD.org> | 2005-07-19 18:09:44 +0000 |
| commit | 287a0ed11aa7008550de72471ca61149ffe8793b (patch) | |
| tree | b61272bfe68a094dcdff604e282885a77edf0e0f /lib | |
| parent | 1fc26580fcbc0b402438a4c701ab4ba82f8b806a (diff) | |
| download | FreeBSD-src-287a0ed11aa7008550de72471ca61149ffe8793b.zip FreeBSD-src-287a0ed11aa7008550de72471ca61149ffe8793b.tar.gz | |
fixed the validation code of routing header length in inet6_rth_getaddr().
reported by Delia Kecskemeti <delia.kecskemeti__at__windriver.com>
Submitted by: Keiichi SHIMA <keiichi__at__iijlab.net>
Obtained from: KAME
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libc/net/rthdr.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/lib/libc/net/rthdr.c b/lib/libc/net/rthdr.c index d7b0077..a1fe2e5 100644 --- a/lib/libc/net/rthdr.c +++ b/lib/libc/net/rthdr.c @@ -417,19 +417,18 @@ inet6_rth_getaddr(const void *bp, int idx) { struct ip6_rthdr *rh = (struct ip6_rthdr *)bp; struct ip6_rthdr0 *rh0; - int rthlen, addrs; + int addrs; switch (rh->ip6r_type) { case IPV6_RTHDR_TYPE_0: rh0 = (struct ip6_rthdr0 *)bp; - rthlen = (rh0->ip6r0_len + 1) << 3; /* * Validation for a type-0 routing header. * Is this too strict? */ - if ((rthlen % 2) != 0 || - (addrs = (rthlen >> 1)) < rh0->ip6r0_segleft) + if ((rh0->ip6r0_len % 2) != 0 || + (addrs = (rh0->ip6r0_len >> 1)) < rh0->ip6r0_segleft) return (NULL); if (idx < 0 || addrs <= idx) |
