diff options
| author | maxv <maxv@NetBSD.org> | 2018-01-19 13:17:29 +0000 |
|---|---|---|
| committer | maxv <maxv@NetBSD.org> | 2018-01-19 13:17:29 +0000 |
| commit | 1a34d4597de0b222d8a7066f1818aa7d34f7658c (patch) | |
| tree | 77da64f310eab017d25377a12545525f7a12c513 /sys/dev/raidframe/raidframeio.h | |
| parent | 688ca3bc97ffdf60555b68a4b57c31f0bc75ecb5 (diff) | |
Fix a buffer overflow in icmp_error. We create in 'm' a packet that must
contain:
IPv4 header | Fixed part of ICMP header | Variable part of ICMP header
But we perform length checks on 'totlen', which does not count the IPv4
header.
So now, add sizeof(struct ip) in totlen, and stop doing this m_data
nonsense, just get the pointers as usual.
Diffstat (limited to 'sys/dev/raidframe/raidframeio.h')
0 files changed, 0 insertions, 0 deletions
