diff options
| author | maxim <maxim@FreeBSD.org> | 2002-10-21 11:43:46 +0000 |
|---|---|---|
| committer | maxim <maxim@FreeBSD.org> | 2002-10-21 11:43:46 +0000 |
| commit | d9971042018a7bfb00c326e1adbd9900d0e81288 (patch) | |
| tree | 2b236b88c079a341b6af7cad19019d690d9a7553 /sbin/ping/ping.c | |
| parent | e48632f546f686469239ba476ea05bf7107cf3d5 (diff) | |
| download | FreeBSD-src-d9971042018a7bfb00c326e1adbd9900d0e81288.zip FreeBSD-src-d9971042018a7bfb00c326e1adbd9900d0e81288.tar.gz | |
Fix LSRR option length check: it has to be less or equal remained header's
length minus sizeof(struct ip).
MFC after: 1 week
Diffstat (limited to 'sbin/ping/ping.c')
| -rw-r--r-- | sbin/ping/ping.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sbin/ping/ping.c b/sbin/ping/ping.c index 99a4c0e..e77d582 100644 --- a/sbin/ping/ping.c +++ b/sbin/ping/ping.c @@ -957,7 +957,8 @@ pr_pack(buf, cc, from, tv) j = cp[IPOPT_OLEN] - IPOPT_MINOFF + 1; hlen -= 2; cp += 2; - if (j >= INADDR_LEN && j <= hlen - INADDR_LEN) { + if (j >= INADDR_LEN && + j <= hlen - (int)sizeof(struct ip)) { for (;;) { bcopy(++cp, &ina.s_addr, INADDR_LEN); if (ina.s_addr == 0) |
