Page MenuHomeFreeBSD
Files F162024518

D22335.id.diff
No OneTemporary
Actions

D22335.id.diff
View Options

Index: head/sys/netinet/ip_carp.c
===================================================================
--- head/sys/netinet/ip_carp.c
+++ head/sys/netinet/ip_carp.c
@@ -567,12 +567,13 @@
/* verify that we have a complete carp packet */
len = m->m_len;
- IP6_EXTHDR_GET(ch, struct carp_header *, m, *offp, sizeof(*ch));
- if (ch == NULL) {
+ m = m_pullup(m, *offp + sizeof(*ch));
+ if (m == NULL) {
CARPSTATS_INC(carps_badlen);
CARP_DEBUG("%s: packet size %u too small\n", __func__, len);
return (IPPROTO_DONE);
}
+ ch = (struct carp_header *)(mtod(m, caddr_t) + *offp);
/* verify the CARP checksum */
Index: head/sys/netinet6/sctp6_usrreq.c
===================================================================
--- head/sys/netinet6/sctp6_usrreq.c
+++ head/sys/netinet6/sctp6_usrreq.c
@@ -103,13 +103,13 @@
SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
/* Get IP, SCTP, and first chunk header together in the first mbuf. */
offset = iphlen + sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr);
- ip6 = mtod(m, struct ip6_hdr *);
- IP6_EXTHDR_GET(sh, struct sctphdr *, m, iphlen,
- (int)(sizeof(struct sctphdr) + sizeof(struct sctp_chunkhdr)));
- if (sh == NULL) {
+ m = m_pullup(m, offset);
+ if (m == NULL) {
SCTP_STAT_INCR(sctps_hdrops);
return (IPPROTO_DONE);
}
+ ip6 = mtod(m, struct ip6_hdr *);
+ sh = (struct sctphdr *)(mtod(m, caddr_t) + iphlen);
ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(struct sctphdr));
offset -= sizeof(struct sctp_chunkhdr);
memset(&src, 0, sizeof(struct sockaddr_in6));
Index: head/sys/netipsec/xform_ah.c
===================================================================
--- head/sys/netipsec/xform_ah.c
+++ head/sys/netipsec/xform_ah.c
@@ -575,14 +575,14 @@
/* Figure out header size. */
rplen = HDRSIZE(sav);
- /* XXX don't pullup, just copy header */
- IP6_EXTHDR_GET(ah, struct newah *, m, skip, rplen);
- if (ah == NULL) {
+ m = m_pullup(m, skip + rplen);
+ if (m == NULL) {
DPRINTF(("ah_input: cannot pullup header\n"));
AHSTAT_INC(ahs_hdrops); /*XXX*/
error = ENOBUFS;
goto bad;
}
+ ah = (struct newah *)(mtod(m, caddr_t) + skip);
/* Check replay window, if applicable. */
SECASVAR_LOCK(sav);
Index: head/sys/netipsec/xform_esp.c
===================================================================
--- head/sys/netipsec/xform_esp.c
+++ head/sys/netipsec/xform_esp.c
@@ -307,8 +307,15 @@
ESPSTAT_INC(esps_badilen);
goto bad;
}
- /* XXX don't pullup, just copy header */
- IP6_EXTHDR_GET(esp, struct newesp *, m, skip, sizeof (struct newesp));
+
+ m = m_pullup(m, skip + sizeof(*esp));
+ if (m == NULL) {
+ DPRINTF(("%s: cannot pullup header\n", __func__));
+ ESPSTAT_INC(esps_hdrops); /*XXX*/
+ error = ENOBUFS;
+ goto bad;
+ }
+ esp = (struct newesp *)(mtod(m, caddr_t) + skip);
esph = sav->tdb_authalgxform;
espx = sav->tdb_encalgxform;

File Metadata

Mime Type
text/plain
Expires
Fri, Jul 10, 12:55 AM (17 h, 22 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
34906712
Default Alt Text
D22335.id.diff (2 KB)

Event Timeline