D56963.diff
No OneTemporary
Actions

Size

716 B

Referenced Files

None

Subscribers

None

D56963.diff
View Options

	diff --git a/sys/netlink/route/rt.c b/sys/netlink/route/rt.c
	--- a/sys/netlink/route/rt.c
	+++ b/sys/netlink/route/rt.c
	@@ -479,8 +479,9 @@
	for (rtnh = (struct rtnexthop *)(nla + 1); data_len > 0; ) {
	struct rta_mpath_nh *mpnh;

	+ len = NL_ITEM_ALIGN(rtnh->rtnh_len);
	if (__predict_false(rtnh->rtnh_len <= sizeof(*rtnh) \|\|
	- rtnh->rtnh_len > data_len)) {
	+ len < rtnh->rtnh_len \|\| len > data_len)) {
	NLMSG_REPORT_ERR_MSG(npt, "%s: bad length %u",
	__func__, rtnh->rtnh_len);
	return (EINVAL);
	@@ -494,7 +495,6 @@
	mp->num_nhops - 1);
	return (error);
	}
	- len = NL_ITEM_ALIGN(rtnh->rtnh_len);
	data_len -= len;
	rtnh = (struct rtnexthop )((char )rtnh + len);
	}