From d31944e6ec798fa765ad8608b52b2fe32435030a Mon Sep 17 00:00:00 2001 From: Jun-ichiro itojun Hagino Date: Mon, 23 Oct 2000 07:11:01 +0000 Subject: be careful on mbuf overrun on ctlinput. short icmp6 packet may be able to panic the kernel. sync with kame. --- sys/netinet/tcp_subr.c | 7 ++++++- sys/netinet/tcp_timewait.c | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) (limited to 'sys/netinet') diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c index 4541f4e06ed5..25c9b66b9da6 100644 --- a/sys/netinet/tcp_subr.c +++ b/sys/netinet/tcp_subr.c @@ -1012,6 +1012,7 @@ tcp6_ctlinput(cmd, sa, d) } else { m = NULL; ip6 = NULL; + off = 0; /* fool gcc */ } /* @@ -1036,7 +1037,11 @@ tcp6_ctlinput(cmd, sa, d) m->m_pkthdr.rcvif != NULL) s.s6_addr16[1] = htons(m->m_pkthdr.rcvif->if_index); - if (m->m_len < off + sizeof(*thp)) { + /* check if we can safely examine src and dst ports */ + if (m->m_pkthdr.len < off + sizeof(th)) + return; + + if (m->m_len < off + sizeof(th)) { /* * this should be rare case * because now MINCLSIZE is "(MHLEN + 1)", diff --git a/sys/netinet/tcp_timewait.c b/sys/netinet/tcp_timewait.c index 4541f4e06ed5..25c9b66b9da6 100644 --- a/sys/netinet/tcp_timewait.c +++ b/sys/netinet/tcp_timewait.c @@ -1012,6 +1012,7 @@ tcp6_ctlinput(cmd, sa, d) } else { m = NULL; ip6 = NULL; + off = 0; /* fool gcc */ } /* @@ -1036,7 +1037,11 @@ tcp6_ctlinput(cmd, sa, d) m->m_pkthdr.rcvif != NULL) s.s6_addr16[1] = htons(m->m_pkthdr.rcvif->if_index); - if (m->m_len < off + sizeof(*thp)) { + /* check if we can safely examine src and dst ports */ + if (m->m_pkthdr.len < off + sizeof(th)) + return; + + if (m->m_len < off + sizeof(th)) { /* * this should be rare case * because now MINCLSIZE is "(MHLEN + 1)", -- cgit v1.3