mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-12 09:58:36 +00:00
Code Issues Releases Activity

ip6_output(): Check the return value of in6_getlinkifnet().

Browse Source 
If the destination address has an embedded scope ID, make sure that it
corresponds to a valid ifnet before proceeding.  Otherwise a sendto()
with a bogus link-local address can trigger a NULL pointer dereference.

Reported by:	syzkaller
Reviewed by:	ae
Fixes:		r358572
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D25887
This commit is contained in:
Mark Johnston 2020-07-30 17:43:23 +00:00
parent 848f8effdd
commit 19afc65a7e
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=363710
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/netinet6/ip6_output.c
View File

@ -761,6 +761,10 @@ ip6_output(struct mbuf *m0, struct ip6_pktopts *opt,
IN6_IS_ADDR_MC_NODELOCAL(&dst_sa.sin6_addr)) {
if (scopeid > 0) {
ifp = in6_getlinkifnet(scopeid);
if (ifp == NULL) {
error = EHOSTUNREACH;
goto bad;
}
*dst = dst_sa; /* XXX */
goto nonh6lookup;
}