diff options
| author | itojun <itojun@NetBSD.org> | 2003-07-04 00:49:18 +0000 |
|---|---|---|
| committer | itojun <itojun@NetBSD.org> | 2003-07-04 00:49:18 +0000 |
| commit | fc401b7586b5977b2bcd2ef774316ef434635477 (patch) | |
| tree | 14975139a0e6beeda42912deff423bd566e4bd05 | |
| parent | 69d5b64f8a805c231fc2b147dbd3e8dcaf47e210 (diff) | |
fix missing check for taillen against pkthdr.len. markus@openbsd
| -rw-r--r-- | sys/netinet6/esp_input.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/netinet6/esp_input.c b/sys/netinet6/esp_input.c index 3546f0d87ed..42e0a137136 100644 --- a/sys/netinet6/esp_input.c +++ b/sys/netinet6/esp_input.c @@ -1,4 +1,4 @@ -/* $NetBSD: esp_input.c,v 1.29 2003/05/14 06:47:39 itojun Exp $ */ +/* $NetBSD: esp_input.c,v 1.30 2003/07/04 00:49:18 itojun Exp $ */ /* $KAME: esp_input.c,v 1.60 2001/09/04 08:43:19 itojun Exp $ */ /* @@ -35,7 +35,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: esp_input.c,v 1.29 2003/05/14 06:47:39 itojun Exp $"); +__KERNEL_RCSID(0, "$NetBSD: esp_input.c,v 1.30 2003/07/04 00:49:18 itojun Exp $"); #include "opt_inet.h" @@ -330,8 +330,8 @@ noreplaycheck: nxt = esptail.esp_nxt; taillen = esptail.esp_padlen + sizeof(esptail); - if (m->m_pkthdr.len < taillen - || m->m_pkthdr.len - taillen < hlen) { /* ? */ + if (m->m_pkthdr.len < taillen || + m->m_pkthdr.len - taillen < off + esplen + ivlen + sizeof(esptail)) { ipseclog((LOG_WARNING, "bad pad length in IPv4 ESP input: %s %s\n", ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav))); |
