diff options
| author | suz <suz@FreeBSD.org> | 2003-10-31 03:18:45 +0000 |
|---|---|---|
| committer | suz <suz@FreeBSD.org> | 2003-10-31 03:18:45 +0000 |
| commit | cbca8b58aa2f74c44531eabda8ca3b4114d5ed3d (patch) | |
| tree | f6487ca5acd7bdb47305f68f28000453c99ad9b5 /usr.sbin/route6d | |
| parent | 30ac6eb1d41ab3bc957fde0b4273d414c0f864ce (diff) | |
| download | FreeBSD-src-cbca8b58aa2f74c44531eabda8ca3b4114d5ed3d.zip FreeBSD-src-cbca8b58aa2f74c44531eabda8ca3b4114d5ed3d.tar.gz | |
fixe remote panic on short packet
Obtained from: KAME
Diffstat (limited to 'usr.sbin/route6d')
| -rw-r--r-- | usr.sbin/route6d/route6d.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/usr.sbin/route6d/route6d.c b/usr.sbin/route6d/route6d.c index 0622918..b19b799 100644 --- a/usr.sbin/route6d/route6d.c +++ b/usr.sbin/route6d/route6d.c @@ -1126,6 +1126,11 @@ riprecv() if (idx && IN6_IS_ADDR_LINKLOCAL(&fsock.sin6_addr)) SET_IN6_LINKLOCAL_IFINDEX(fsock.sin6_addr, idx); + if (len < sizeof(struct rip6)) { + trace(1, "Packet too short\n"); + return; + } + nh = fsock.sin6_addr; nn = (len - sizeof(struct rip6) + sizeof(struct netinfo6)) / sizeof(struct netinfo6); |
