diff options
| author | suz <suz@FreeBSD.org> | 2006-03-23 14:39:38 +0000 |
|---|---|---|
| committer | suz <suz@FreeBSD.org> | 2006-03-23 14:39:38 +0000 |
| commit | 20b21e2a365bc74e02d8e029b0c9b0fdce905f27 (patch) | |
| tree | f9bab8a7bdd603e7a4153e739e46ef58c206540d /usr.sbin/rtadvd | |
| parent | ec17f7788515f838ae8c595748fbd664f1e2f1f1 (diff) | |
| download | FreeBSD-src-20b21e2a365bc74e02d8e029b0c9b0fdce905f27.zip FreeBSD-src-20b21e2a365bc74e02d8e029b0c9b0fdce905f27.tar.gz | |
avoid heap overrun
Obtained from: KAME
MFC after: 1 day
Diffstat (limited to 'usr.sbin/rtadvd')
| -rw-r--r-- | usr.sbin/rtadvd/config.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/usr.sbin/rtadvd/config.c b/usr.sbin/rtadvd/config.c index 000cd3a..4682e98 100644 --- a/usr.sbin/rtadvd/config.c +++ b/usr.sbin/rtadvd/config.c @@ -656,7 +656,7 @@ get_prefix(struct rainfo *rai) memcpy(&pp->prefix, a, sizeof(*a)); p = (u_char *)&pp->prefix; ep = (u_char *)(&pp->prefix + 1); - while (m < lim) + while (m < lim && p < ep) *p++ &= *m++; while (p < ep) *p++ = 0x00; |
