diff options
| author | Michael Tuexen <tuexen@FreeBSD.org> | 2017-06-01 08:04:09 +0000 |
|---|---|---|
| committer | Michael Tuexen <tuexen@FreeBSD.org> | 2017-06-01 08:04:09 +0000 |
| commit | d2a6ff75f300400daf5090eaeba26f33f1fde9ab (patch) | |
| tree | f85218214ffe420754b6e385e74ebd1bc0f9621e | |
| parent | 7d715cf1e1850d51ae6c80e77692acad67add65e (diff) | |
Notes
| -rw-r--r-- | sys/netinet/raw_ip.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c index 661bbf49f29d..b79bbd03777c 100644 --- a/sys/netinet/raw_ip.c +++ b/sys/netinet/raw_ip.c @@ -507,7 +507,7 @@ rip_output(struct mbuf *m, struct socket *so, ...) * and don't allow packet length sizes that will crash. */ if (((ip->ip_hl != (sizeof (*ip) >> 2)) && inp->inp_options) - || (ntohs(ip->ip_len) > m->m_pkthdr.len) + || (ntohs(ip->ip_len) != m->m_pkthdr.len) || (ntohs(ip->ip_len) < (ip->ip_hl << 2))) { INP_RUNLOCK(inp); m_freem(m); |