diff options
| author | kris <kris@FreeBSD.org> | 2001-02-26 03:41:13 +0000 |
|---|---|---|
| committer | kris <kris@FreeBSD.org> | 2001-02-26 03:41:13 +0000 |
| commit | f13b6fe378f977bb101bdefab5288f0ba5ebf18b (patch) | |
| tree | d316f4cc8646f50e64e2674752d10e9b69041c42 /sys/netinet6/ah_output.c | |
| parent | a7a408f67ff21a3e24c002cf0007bde818da83fc (diff) | |
| download | FreeBSD-src-f13b6fe378f977bb101bdefab5288f0ba5ebf18b.zip FreeBSD-src-f13b6fe378f977bb101bdefab5288f0ba5ebf18b.tar.gz | |
More IP option length validation.
Includes the following revisions from KAME (two of these were actually
committed previously but the CVS revisions weren't documented):
1.40 kame/kame/sys/netinet6/ah_core.c (committed in previous rev)
1.41 kame/kame/sys/netinet6/ah_core.c
1.28 kame/kame/sys/netinet6/ah_output.c (committed in previous rev)
1.29 kame/kame/sys/netinet6/ah_output.c
1.30 kame/kame/sys/netinet6/ah_output.c
1.129 kame/kame/sys/netinet6/nd6.c
1.130 kame/kame/sys/netinet6/nd6.c
1.24 kame/kame/sys/netinet6/dest6.c
1.25 kame/kame/sys/netinet6/dest6.c
Obtained from: KAME
Diffstat (limited to 'sys/netinet6/ah_output.c')
| -rw-r--r-- | sys/netinet6/ah_output.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/netinet6/ah_output.c b/sys/netinet6/ah_output.c index df9f4d5..59263cd 100644 --- a/sys/netinet6/ah_output.c +++ b/sys/netinet6/ah_output.c @@ -539,8 +539,8 @@ ah4_finaldst(m) break; case IPOPT_LSRR: case IPOPT_SSRR: - if (q[i + IPOPT_OLEN] <= 0 - || optlen - i < q[i + IPOPT_OLEN]) { + if (q[i + IPOPT_OLEN] < 2 + sizeof(struct in_addr) || + optlen - i < q[i + IPOPT_OLEN]) { ipseclog((LOG_ERR, "ip_finaldst: invalid IP option " "(code=%02x len=%02x)\n", @@ -550,8 +550,8 @@ ah4_finaldst(m) i += q[i + IPOPT_OLEN] - sizeof(struct in_addr); return (struct in_addr *)(q + i); default: - if (q[i + IPOPT_OLEN] <= 0 - || optlen - i < q[i + IPOPT_OLEN]) { + if (q[i + IPOPT_OLEN] < 2 || + optlen - i < q[i + IPOPT_OLEN]) { ipseclog((LOG_ERR, "ip_finaldst: invalid IP option " "(code=%02x len=%02x)\n", |
