Module Name: src Committed By: martin Date: Fri Feb 16 16:39:05 UTC 2018
Modified Files: src/sys/netipsec [netbsd-7]: ipsec.c Log Message: Pull up following revision(s) (requested by maxv in ticket #1570): sys/netipsec/ipsec.c: revision 1.130 Fix inverted logic, otherwise the kernel crashes when receiving a 1-byte AH packet. Triggerable before authentication when IPsec and forwarding are both enabled. To generate a diff of this commit: cvs rdiff -u -r1.63 -r1.63.2.1 src/sys/netipsec/ipsec.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/netipsec/ipsec.c diff -u src/sys/netipsec/ipsec.c:1.63 src/sys/netipsec/ipsec.c:1.63.2.1 --- src/sys/netipsec/ipsec.c:1.63 Fri May 30 01:39:03 2014 +++ src/sys/netipsec/ipsec.c Fri Feb 16 16:39:05 2018 @@ -1,4 +1,4 @@ -/* $NetBSD: ipsec.c,v 1.63 2014/05/30 01:39:03 christos Exp $ */ +/* $NetBSD: ipsec.c,v 1.63.2.1 2018/02/16 16:39:05 martin Exp $ */ /* $FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $ */ /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */ @@ -32,7 +32,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.63 2014/05/30 01:39:03 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.63.2.1 2018/02/16 16:39:05 martin Exp $"); /* * IPsec controller part. @@ -1176,7 +1176,7 @@ ipsec4_get_ulp(struct mbuf *m, struct se spidx->dst.sin.sin_port = uh.uh_dport; return; case IPPROTO_AH: - if (m->m_pkthdr.len > off + sizeof(ip6e)) + if (off + sizeof(ip6e) > m->m_pkthdr.len) goto done; /* XXX sigh, this works but is totally bogus */ m_copydata(m, off, sizeof(ip6e), &ip6e);