diff options
| author | bz <bz@FreeBSD.org> | 2010-10-23 20:35:40 +0000 |
|---|---|---|
| committer | bz <bz@FreeBSD.org> | 2010-10-23 20:35:40 +0000 |
| commit | de9392f9e014151a889a4d86de9f6736a94f158e (patch) | |
| tree | f5d45570646bf96cfcb9125ee6a33290a6a158e2 /sys/netipsec/ipsec_output.c | |
| parent | 1f7e8301f37d1383a1b54e2fd57a8f750ee42848 (diff) | |
| download | FreeBSD-src-de9392f9e014151a889a4d86de9f6736a94f158e.zip FreeBSD-src-de9392f9e014151a889a4d86de9f6736a94f158e.tar.gz | |
Make the IPsec SADB embedded route cache a union to be able to hold both the
legacy and IPv6 route destination address.
Previously in case of IPv6, there was a memory overwrite due to not enough
space for the IPv6 address.
PR: kern/122565
MFC After: 2 weeks
Diffstat (limited to 'sys/netipsec/ipsec_output.c')
| -rw-r--r-- | sys/netipsec/ipsec_output.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/netipsec/ipsec_output.c b/sys/netipsec/ipsec_output.c index 2701796..0907f45 100644 --- a/sys/netipsec/ipsec_output.c +++ b/sys/netipsec/ipsec_output.c @@ -829,7 +829,8 @@ ipsec6_output_tunnel(struct ipsec_output_state *state, struct secpolicy *sp, int } ip6 = mtod(m, struct ip6_hdr *); - state->ro = &isr->sav->sah->sa_route; + state->ro = + (struct route *)&isr->sav->sah->route_cache.sin6_route; state->dst = (struct sockaddr *)&state->ro->ro_dst; dst6 = (struct sockaddr_in6 *)state->dst; if (state->ro->ro_rt |
