Change Details

ping -R (F_RROUTE) will loop at ping.c:1381 until it segfaults: slippy$ ping -R 192.168.0.101 PING 192.168.0.101 (192.168.0.101): 56 data bytes 64 bytes from 192.168.0.101: icmp_seq=0 ttl=63 time=1.081 ms RR: 192.168.0.1 192.168.0.101 192.168.0.101 10.1.1.254 10.1.1.91 unknown option bb unknown option 32 unknown option 6 ... unknown option 96 unknown option 2d Segmentation fault The reason for this is while looping through loose source routing and strict source routing, hlen can become negative, terminating the loop. However, when hlen is unsigned, it becomes a large number causing the loop to continue virtually forever hlen is by chance smaller than an IP header. This fixes a regression introduced by 46d7b45a267b. This should be MFCed to 13.2 prior to release.

ping -R (F_RROUTE) will loop at ping.c:1381 until it segfaults: slippy$ ping -R 192.168.0.101 PING 192.168.0.101 (192.168.0.101): 56 data bytes 64 bytes from 192.168.0.101: icmp_seq=0 ttl=63 time=1.081 ms RR: 192.168.0.1 192.168.0.101 192.168.0.101 10.1.1.254 10.1.1.91 unknown option bb unknown option 32 unknown option 6 ... unknown option 96 unknown option 2d Segmentation fault The reason for this is while looping through loose source routing and strict source routing, hlen will become negative, terminating the loop. However, when hlen is unsigned, it wraps around becoming a large number causing the loop to continue virtually forever until hlen is by chance smaller than an IP header. Fixes: 46d7b45a267b This should be MFCed to 13.2 prior to release.

ping -R (F_RROUTE) will loop at ping.c:1381 until it segfaults: slippy$ ping -R 192.168.0.101 PING 192.168.0.101 (192.168.0.101): 56 data bytes 64 bytes from 192.168.0.101: icmp_seq=0 ttl=63 time=1.081 ms RR: 192.168.0.1 192.168.0.101 192.168.0.101 10.1.1.254 10.1.1.91 unknown option bb unknown option 32 unknown option 6 ... unknown option 96 unknown option 2d Segmentation fault The reason for this is while looping through loose source routing and strict source routing, hlen canwill become negative, terminating the loop. However, when hlen is unsigned, itit wraps around becomesing a large number causing causing the loop to continue virtually forever until hlen is by chance smaller thane smaller than an IP header. This fFixes a regression introduced by: 46d7b45a267b. This should be MFCed to 13.2 prior to release.