diff options
| author | Renato Botelho <renato@netgate.com> | 2016-01-14 09:33:16 -0200 |
|---|---|---|
| committer | Renato Botelho <renato@netgate.com> | 2016-01-14 09:33:16 -0200 |
| commit | 58b7eab7d39d983cc70f6f1d611f00470a76fca1 (patch) | |
| tree | bb36653da0e7ff3eb5ec994f6923513a77973ba0 /sys/netinet6 | |
| parent | 3e0bf52f358eb969d165c4b1e54942ee94cf2c8d (diff) | |
| parent | e9becf4ed022809a585e21a1d3da8a3a233ff648 (diff) | |
| download | FreeBSD-src-58b7eab7d39d983cc70f6f1d611f00470a76fca1.zip FreeBSD-src-58b7eab7d39d983cc70f6f1d611f00470a76fca1.tar.gz | |
Merge remote-tracking branch 'origin/stable/10' into devel
Diffstat (limited to 'sys/netinet6')
| -rw-r--r-- | sys/netinet6/sctp6_usrreq.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/sys/netinet6/sctp6_usrreq.c b/sys/netinet6/sctp6_usrreq.c index 536cc91..7670289 100644 --- a/sys/netinet6/sctp6_usrreq.c +++ b/sys/netinet6/sctp6_usrreq.c @@ -386,7 +386,6 @@ sctp6_ctlinput(int cmd, struct sockaddr *pktdst, void *d) * XXX: We assume that when IPV6 is non NULL, M and OFF are * valid. */ - /* check if we can safely examine src and dst ports */ struct sctp_inpcb *inp = NULL; struct sctp_tcb *stcb = NULL; struct sctp_nets *net = NULL; @@ -395,6 +394,10 @@ sctp6_ctlinput(int cmd, struct sockaddr *pktdst, void *d) if (ip6cp->ip6c_m == NULL) return; + /* Check if we can safely examine the SCTP header. */ + if (ip6cp->ip6c_m->m_pkthdr.len < ip6cp->ip6c_off + sizeof(sh)) + return; + bzero(&sh, sizeof(sh)); bzero(&final, sizeof(final)); inp = NULL; |
