diff options
| author | dg <dg@FreeBSD.org> | 1998-05-24 14:59:57 +0000 |
|---|---|---|
| committer | dg <dg@FreeBSD.org> | 1998-05-24 14:59:57 +0000 |
| commit | 1b7405b9552ec7d650786670ccc179553f750a79 (patch) | |
| tree | 0c4e7988d8aac9d7db816df1a7ad54d7d9cc8bda /sys | |
| parent | 6d06da81011cebd1efc4dae1d6d0ed94af6f9f76 (diff) | |
| download | FreeBSD-src-1b7405b9552ec7d650786670ccc179553f750a79.zip FreeBSD-src-1b7405b9552ec7d650786670ccc179553f750a79.tar.gz | |
The ipt_ptr field is 1-based (see TCP/IP Illustrated, Vol. 1, pp. 91-95),
so it must be adjusted (minus 1) before using it to do the length check.
I'm not sure who to give the credit to, but the bug was reported by
Jennifer Dawn Myers <jdm@enteract.com>, who also supplied a patch. It
was also fixed in OpenBSD previously by andreas.gunnarsson@emw.ericsson.se,
and of course I did the homework to verify that the fix was correct per
the specification.
PR: 6738
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/netinet/ip_input.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index 5f0eced..f80c483 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 - * $Id: ip_input.c,v 1.82 1998/04/13 17:27:08 phk Exp $ + * $Id: ip_input.c,v 1.83 1998/05/19 14:04:32 dg Exp $ * $ANA: ip_input.c,v 1.5 1996/09/18 14:34:59 wollman Exp $ */ @@ -1068,7 +1068,7 @@ nosourcerouting: break; case IPOPT_TS_TSANDADDR: - if (ipt->ipt_ptr + sizeof(n_time) + + if (ipt->ipt_ptr - 1 + sizeof(n_time) + sizeof(struct in_addr) > ipt->ipt_len) goto bad; ipaddr.sin_addr = dst; @@ -1082,7 +1082,7 @@ nosourcerouting: break; case IPOPT_TS_PRESPEC: - if (ipt->ipt_ptr + sizeof(n_time) + + if (ipt->ipt_ptr - 1 + sizeof(n_time) + sizeof(struct in_addr) > ipt->ipt_len) goto bad; (void)memcpy(&ipaddr.sin_addr, sin, |
