CVSROOT: /cvs
Module name: src
Changes by: m...@cvs.openbsd.org 2020/05/06 01:08:53
Modified files:
sys/netinet6 : ip6_input.c
Log message:
Do sanity checks in ip6_pullexthdr() preventing a panic in m_copydata(9).
An invalid/corrupted hop6 option in rip6_input()/ip6_savecontrol() could
lead m_copydata(9)s' check to trigger a panic.
Fix from maxv@NetBSD where the problem was also reported by syzkaller.
Reported-by: syzbot+3b07b3511b4ceb8bf...@syzkaller.appspotmail.com
Reported-by: syzbot+7ee0eb2691d507fca...@syzkaller.appspotmail.com
ok sashan@, dlg@, claudio@, deraadt@
