diff options
| author | delphij <delphij@FreeBSD.org> | 2015-02-25 05:43:02 +0000 |
|---|---|---|
| committer | delphij <delphij@FreeBSD.org> | 2015-02-25 05:43:02 +0000 |
| commit | 9d303d647b44e264c5b8fb43ad4d840091db792c (patch) | |
| tree | 96137bbb280af42f9c92b5157a9adad61623a860 /sys/netinet | |
| parent | 41a96ed99bbd2897e1de81b52b0eec6640b7f637 (diff) | |
| download | FreeBSD-src-9d303d647b44e264c5b8fb43ad4d840091db792c.zip FreeBSD-src-9d303d647b44e264c5b8fb43ad4d840091db792c.tar.gz | |
Instant MFC:
Fix integer overflow in IGMP protocol.
Security: FreeBSD-SA-15:04.igmp
Security: CVE-2015-1414
Found by: Mateusz Kocielski, Logicaltrust
Analyzed by: Marek Kroemeke, Mateusz Kocielski (shm@NetBSD.org) and
22733db72ab3ed94b5f8a1ffcde850251fe6f466
Submited by: Mariusz Zaborski <oshogbo@FreeBSD.org>
Reviewed by: bms
Approved by: so
Diffstat (limited to 'sys/netinet')
| -rw-r--r-- | sys/netinet/igmp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c index 9f31a19..908f304 100644 --- a/sys/netinet/igmp.c +++ b/sys/netinet/igmp.c @@ -1533,8 +1533,8 @@ igmp_input(struct mbuf *m, int off) case IGMP_VERSION_3: { struct igmpv3 *igmpv3; uint16_t igmpv3len; - uint16_t srclen; - int nsrc; + uint16_t nsrc; + int srclen; IGMPSTAT_INC(igps_rcv_v3_queries); igmpv3 = (struct igmpv3 *)igmp; |
