talexander
/
freebsd_amp_hwpstate
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

be careful on mbuf overrun on ctlinput. 

short icmp6 packet may be able to panic the kernel.
sync with kame.
This commit is contained in:
Jun-ichiro itojun Hagino 2000-10-23 07:11:01 +00:00
parent a91a9fde81
commit d31944e6ec
3 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sys/netinet/tcp_subr.c
View File

@ -1012,6 +1012,7 @@ tcp6_ctlinput(cmd, sa, d)
} else {
m = NULL;
ip6 = NULL;
off = 0; /* fool gcc */
}
/*
@ -1036,7 +1037,11 @@ tcp6_ctlinput(cmd, sa, d)
m->m_pkthdr.rcvif != NULL)
s.s6_addr16[1] = htons(m->m_pkthdr.rcvif->if_index);
if (m->m_len < off + sizeof(*thp)) {
/* check if we can safely examine src and dst ports */
if (m->m_pkthdr.len < off + sizeof(th))
return;
if (m->m_len < off + sizeof(th)) {
/*
* this should be rare case
* because now MINCLSIZE is "(MHLEN + 1)",

7
sys/netinet/tcp_timewait.c
View File

@ -1012,6 +1012,7 @@ tcp6_ctlinput(cmd, sa, d)
} else {
m = NULL;
ip6 = NULL;
off = 0; /* fool gcc */
}
/*
@ -1036,7 +1037,11 @@ tcp6_ctlinput(cmd, sa, d)
m->m_pkthdr.rcvif != NULL)
s.s6_addr16[1] = htons(m->m_pkthdr.rcvif->if_index);
if (m->m_len < off + sizeof(*thp)) {
/* check if we can safely examine src and dst ports */
if (m->m_pkthdr.len < off + sizeof(th))
return;
if (m->m_len < off + sizeof(th)) {
/*
* this should be rare case
* because now MINCLSIZE is "(MHLEN + 1)",

6
sys/netinet6/udp6_usrreq.c
View File

@ -1,5 +1,5 @@
/* $FreeBSD$ */
/* $KAME: udp6_usrreq.c,v 1.11 2000/06/18 06:23:06 jinmei Exp $ */
/* $KAME: udp6_usrreq.c,v 1.17 2000/10/13 17:46:21 itojun Exp $ */
/*
* Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@ -450,6 +450,10 @@ udp6_ctlinput(cmd, sa, d)
if (IN6_IS_ADDR_LINKLOCAL(&s))
s.s6_addr16[1] = htons(m->m_pkthdr.rcvif->if_index);
/* check if we can safely examine src and dst ports */
if (m->m_pkthdr.len < off + sizeof(uh))
return;
if (m->m_len < off + sizeof(uh)) {
/*
* this should be rare case,