summaryrefslogtreecommitdiff
path: root/sys
diff options
context:
space:
mode:
authoritojun <itojun@NetBSD.org>2000-06-08 13:51:33 +0000
committeritojun <itojun@NetBSD.org>2000-06-08 13:51:33 +0000
commitffedfcb68dd6f3d7970b471c52f26e2b87cd5e79 (patch)
tree9e7aae05f3398bb647f80c67914ddd22f4ac2f10 /sys
parentd530ee00d12a33c12ae24aad986ffd8f3a68013f (diff)
make sure not to overwrite sockaddr on PRU_SEND/PRU_CONNECT to
link-local address. From: frank
Diffstat (limited to 'sys')
-rw-r--r--sys/netinet6/in6_pcb.c7
-rw-r--r--sys/netinet6/udp6_usrreq.c7
2 files changed, 12 insertions, 2 deletions
diff --git a/sys/netinet6/in6_pcb.c b/sys/netinet6/in6_pcb.c
index 77b10df9009..d0973ce7294 100644
--- a/sys/netinet6/in6_pcb.c
+++ b/sys/netinet6/in6_pcb.c
@@ -1,4 +1,4 @@
-/* $NetBSD: in6_pcb.c,v 1.25 2000/06/05 08:09:48 itojun Exp $ */
+/* $NetBSD: in6_pcb.c,v 1.26 2000/06/08 13:51:33 itojun Exp $ */
/* $KAME: in6_pcb.c,v 1.45 2000/06/05 00:41:58 itojun Exp $ */
/*
@@ -307,6 +307,7 @@ in6_pcbconnect(in6p, nam)
struct ifnet *ifp = NULL; /* outgoing interface */
int error = 0;
struct in6_addr mapped;
+ struct sockaddr_in6 tmp;
(void)&in6a; /* XXX fool gcc */
@@ -328,6 +329,10 @@ in6_pcbconnect(in6p, nam)
return EINVAL;
}
+ /* protect *sin6 from overwrites */
+ tmp = *sin6;
+ sin6 = &tmp;
+
/*
* If the scope of the destination is link-local, embed the interface
* index in the address.
diff --git a/sys/netinet6/udp6_usrreq.c b/sys/netinet6/udp6_usrreq.c
index ce75b6a57b5..846ac477d1c 100644
--- a/sys/netinet6/udp6_usrreq.c
+++ b/sys/netinet6/udp6_usrreq.c
@@ -1,4 +1,4 @@
-/* $NetBSD: udp6_usrreq.c,v 1.29 2000/06/05 06:38:23 itojun Exp $ */
+/* $NetBSD: udp6_usrreq.c,v 1.30 2000/06/08 13:51:34 itojun Exp $ */
/* $KAME: udp6_usrreq.c,v 1.52 2000/06/05 00:41:58 itojun Exp $ */
/*
@@ -566,6 +566,7 @@ udp6_output(in6p, m, addr6, control, p)
#ifdef INET
struct ip *ip;
#endif
+ struct sockaddr_in6 tmp;
priv = 0;
if (p && !suser(p->p_ucred, &p->p_acflag))
@@ -605,6 +606,10 @@ udp6_output(in6p, m, addr6, control, p)
goto release;
}
+ /* protect *sin6 from overwrites */
+ tmp = *sin6;
+ sin6 = &tmp;
+
faddr = &sin6->sin6_addr;
fport = sin6->sin6_port; /* allow 0 port */
/*