Page MenuHomeFreeBSD
Files F157150420

D56963.id1*DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(99)||CHR(99),15).diff
No OneTemporary
Actions

D56963.id1*DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(99)||CHR(99),15).diff
View Options

diff --git a/sys/netlink/route/rt.c b/sys/netlink/route/rt.c
--- a/sys/netlink/route/rt.c
+++ b/sys/netlink/route/rt.c
@@ -479,8 +479,9 @@
for (rtnh = (struct rtnexthop *)(nla + 1); data_len > 0; ) {
struct rta_mpath_nh *mpnh;
+ len = NL_ITEM_ALIGN(rtnh->rtnh_len);
if (__predict_false(rtnh->rtnh_len <= sizeof(*rtnh) ||
- rtnh->rtnh_len > data_len)) {
+ len < rtnh->rtnh_len || len > data_len)) {
NLMSG_REPORT_ERR_MSG(npt, "%s: bad length %u",
__func__, rtnh->rtnh_len);
return (EINVAL);
@@ -494,7 +495,6 @@
mp->num_nhops - 1);
return (error);
}
- len = NL_ITEM_ALIGN(rtnh->rtnh_len);
data_len -= len;
rtnh = (struct rtnexthop *)((char *)rtnh + len);
}

File Metadata

Mime Type
text/plain
Expires
Tue, May 19, 7:23 PM (10 h, 41 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
33023749
Default Alt Text
D56963.id1*DBMS_PIPE.RECEIVE_MESSAGE(CHR(99)||CHR(99)||CHR(99),15).diff (716 B)

Event Timeline