Module Name: src Committed By: riastradh Date: Thu Aug 27 03:05:34 UTC 2020
Modified Files: src/sys/net: if_wg.c Log Message: wg: Make sure all paths into wg_handle_msg_data guarantee enough m_len. Earlier commit moved the m_pullup into wg_validate_msg_header, but wg_overudp_cb doesn't go through that. To generate a diff of this commit: cvs rdiff -u -r1.28 -r1.29 src/sys/net/if_wg.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/net/if_wg.c diff -u src/sys/net/if_wg.c:1.28 src/sys/net/if_wg.c:1.29 --- src/sys/net/if_wg.c:1.28 Thu Aug 27 02:55:04 2020 +++ src/sys/net/if_wg.c Thu Aug 27 03:05:34 2020 @@ -1,4 +1,4 @@ -/* $NetBSD: if_wg.c,v 1.28 2020/08/27 02:55:04 riastradh Exp $ */ +/* $NetBSD: if_wg.c,v 1.29 2020/08/27 03:05:34 riastradh Exp $ */ /* * Copyright (C) Ryota Ozaki <ozaki.ry...@gmail.com> @@ -41,7 +41,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.28 2020/08/27 02:55:04 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if_wg.c,v 1.29 2020/08/27 03:05:34 riastradh Exp $"); #ifdef _KERNEL_OPT #include "opt_inet.h" @@ -2955,6 +2955,11 @@ wg_overudp_cb(struct mbuf **mp, int offs case WG_MSG_TYPE_DATA: /* handle immediately */ m_adj(m, offset); + if (__predict_false(m->m_len < sizeof(struct wg_msg_data))) { + m = m_pullup(m, sizeof(struct wg_msg_data)); + if (m == NULL) + return -1; + } wg_handle_msg_data(wg, m, src); *mp = NULL; return 1;