diff options
| author | itojun <itojun@NetBSD.org> | 2000-06-08 13:51:33 +0000 |
|---|---|---|
| committer | itojun <itojun@NetBSD.org> | 2000-06-08 13:51:33 +0000 |
| commit | ffedfcb68dd6f3d7970b471c52f26e2b87cd5e79 (patch) | |
| tree | 9e7aae05f3398bb647f80c67914ddd22f4ac2f10 /sys | |
| parent | d530ee00d12a33c12ae24aad986ffd8f3a68013f (diff) | |
make sure not to overwrite sockaddr on PRU_SEND/PRU_CONNECT to
link-local address. From: frank
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/netinet6/in6_pcb.c | 7 | ||||
| -rw-r--r-- | sys/netinet6/udp6_usrreq.c | 7 |
2 files changed, 12 insertions, 2 deletions
diff --git a/sys/netinet6/in6_pcb.c b/sys/netinet6/in6_pcb.c index 77b10df9009..d0973ce7294 100644 --- a/sys/netinet6/in6_pcb.c +++ b/sys/netinet6/in6_pcb.c @@ -1,4 +1,4 @@ -/* $NetBSD: in6_pcb.c,v 1.25 2000/06/05 08:09:48 itojun Exp $ */ +/* $NetBSD: in6_pcb.c,v 1.26 2000/06/08 13:51:33 itojun Exp $ */ /* $KAME: in6_pcb.c,v 1.45 2000/06/05 00:41:58 itojun Exp $ */ /* @@ -307,6 +307,7 @@ in6_pcbconnect(in6p, nam) struct ifnet *ifp = NULL; /* outgoing interface */ int error = 0; struct in6_addr mapped; + struct sockaddr_in6 tmp; (void)&in6a; /* XXX fool gcc */ @@ -328,6 +329,10 @@ in6_pcbconnect(in6p, nam) return EINVAL; } + /* protect *sin6 from overwrites */ + tmp = *sin6; + sin6 = &tmp; + /* * If the scope of the destination is link-local, embed the interface * index in the address. diff --git a/sys/netinet6/udp6_usrreq.c b/sys/netinet6/udp6_usrreq.c index ce75b6a57b5..846ac477d1c 100644 --- a/sys/netinet6/udp6_usrreq.c +++ b/sys/netinet6/udp6_usrreq.c @@ -1,4 +1,4 @@ -/* $NetBSD: udp6_usrreq.c,v 1.29 2000/06/05 06:38:23 itojun Exp $ */ +/* $NetBSD: udp6_usrreq.c,v 1.30 2000/06/08 13:51:34 itojun Exp $ */ /* $KAME: udp6_usrreq.c,v 1.52 2000/06/05 00:41:58 itojun Exp $ */ /* @@ -566,6 +566,7 @@ udp6_output(in6p, m, addr6, control, p) #ifdef INET struct ip *ip; #endif + struct sockaddr_in6 tmp; priv = 0; if (p && !suser(p->p_ucred, &p->p_acflag)) @@ -605,6 +606,10 @@ udp6_output(in6p, m, addr6, control, p) goto release; } + /* protect *sin6 from overwrites */ + tmp = *sin6; + sin6 = &tmp; + faddr = &sin6->sin6_addr; fport = sin6->sin6_port; /* allow 0 port */ /* |
