diff options
| author | Theo de Raadt <deraadt@cvs.openbsd.org> | 1998-12-15 02:26:36 +0000 |
|---|---|---|
| committer | Theo de Raadt <deraadt@cvs.openbsd.org> | 1998-12-15 02:26:36 +0000 |
| commit | dc6e6fe48f426c4c4dd8265b5d5d8cefbec43484 (patch) | |
| tree | c2888dccc33d4b7e03c8a6badc3fed8418ce7a89 /sys/netinet | |
| parent | ad3209ab6a39f87faf0d2171cdfc73eb5d46df8d (diff) | |
check for valid ip_hl too; route@infonexus.com
Diffstat (limited to 'sys/netinet')
| -rw-r--r-- | sys/netinet/raw_ip.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c index 5ca4b919dcc..36a70c186b5 100644 --- a/sys/netinet/raw_ip.c +++ b/sys/netinet/raw_ip.c @@ -1,4 +1,4 @@ -/* $OpenBSD: raw_ip.c,v 1.11 1998/05/18 21:11:04 provos Exp $ */ +/* $OpenBSD: raw_ip.c,v 1.12 1998/12/15 02:26:35 deraadt Exp $ */ /* $NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $ */ /* @@ -201,7 +201,8 @@ rip_output(m, va_alist) * and don't allow packet length sizes that will crash */ if ((ip->ip_hl != (sizeof (*ip) >> 2) && inp->inp_options) || - ip->ip_len > m->m_pkthdr.len) { + ip->ip_len > m->m_pkthdr.len || + ip->ip_len < ip->ip_hl << 2) { m_freem(m); return (EINVAL); } |