summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authoritojun <itojun@NetBSD.org>2003-07-04 00:49:18 +0000
committeritojun <itojun@NetBSD.org>2003-07-04 00:49:18 +0000
commitfc401b7586b5977b2bcd2ef774316ef434635477 (patch)
tree14975139a0e6beeda42912deff423bd566e4bd05
parent69d5b64f8a805c231fc2b147dbd3e8dcaf47e210 (diff)
fix missing check for taillen against pkthdr.len. markus@openbsd
-rw-r--r--sys/netinet6/esp_input.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/netinet6/esp_input.c b/sys/netinet6/esp_input.c
index 3546f0d87ed..42e0a137136 100644
--- a/sys/netinet6/esp_input.c
+++ b/sys/netinet6/esp_input.c
@@ -1,4 +1,4 @@
-/* $NetBSD: esp_input.c,v 1.29 2003/05/14 06:47:39 itojun Exp $ */
+/* $NetBSD: esp_input.c,v 1.30 2003/07/04 00:49:18 itojun Exp $ */
/* $KAME: esp_input.c,v 1.60 2001/09/04 08:43:19 itojun Exp $ */
/*
@@ -35,7 +35,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: esp_input.c,v 1.29 2003/05/14 06:47:39 itojun Exp $");
+__KERNEL_RCSID(0, "$NetBSD: esp_input.c,v 1.30 2003/07/04 00:49:18 itojun Exp $");
#include "opt_inet.h"
@@ -330,8 +330,8 @@ noreplaycheck:
nxt = esptail.esp_nxt;
taillen = esptail.esp_padlen + sizeof(esptail);
- if (m->m_pkthdr.len < taillen
- || m->m_pkthdr.len - taillen < hlen) { /* ? */
+ if (m->m_pkthdr.len < taillen ||
+ m->m_pkthdr.len - taillen < off + esplen + ivlen + sizeof(esptail)) {
ipseclog((LOG_WARNING,
"bad pad length in IPv4 ESP input: %s %s\n",
ipsec4_logpacketstr(ip, spi), ipsec_logsastr(sav)));