From 5801ece863be8ec6a9f785c3cb3d97c62499c7ea Mon Sep 17 00:00:00 2001
From: glebius <glebius@FreeBSD.org>
Date: Fri, 11 Feb 2005 21:26:39 +0000
Subject: pullup to sizeof struct ip before sending to ip_output.

Suggested by:	ru
---
 sys/netgraph/ng_ipfw.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'sys/netgraph/ng_ipfw.c')

diff --git a/sys/netgraph/ng_ipfw.c b/sys/netgraph/ng_ipfw.c
index e7325dc..2fab936 100644
--- a/sys/netgraph/ng_ipfw.c
+++ b/sys/netgraph/ng_ipfw.c
@@ -229,7 +229,13 @@ ng_ipfw_rcvdata(hook_p hook, item_p item)
 	switch (ngit->dir) {
 	case NG_IPFW_OUT:
 	    {
-		struct ip *ip = mtod(m, struct ip *);
+		struct ip *ip;
+
+		if (m->m_len < sizeof (struct ip) &&
+			(m = m_pullup(m, sizeof (struct ip))) == NULL)
+				return(EINVAL);
+
+		ip = mtod(m, struct ip *);
 
 		ip->ip_len = ntohs(ip->ip_len);
 		ip->ip_off = ntohs(ip->ip_off);
-- 
cgit v1.1