diff options
| author | Jun-ichiro itojun Hagino <itojun@cvs.openbsd.org> | 2003-03-14 18:33:59 +0000 |
|---|---|---|
| committer | Jun-ichiro itojun Hagino <itojun@cvs.openbsd.org> | 2003-03-14 18:33:59 +0000 |
| commit | 84d0b52196af5046aee795877695071aec11231a (patch) | |
| tree | 076bd773feaa1c2d200674ecfa88a791b6106d01 /usr.sbin | |
| parent | 3151fbe76124ae5f849a37690ca9a051780b9da4 (diff) | |
add missing ND option length validation. from kame
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/rtadvd/rtadvd.c | 27 |
1 files changed, 25 insertions, 2 deletions
diff --git a/usr.sbin/rtadvd/rtadvd.c b/usr.sbin/rtadvd/rtadvd.c index ba15bf62b66..d6eb278be7e 100644 --- a/usr.sbin/rtadvd/rtadvd.c +++ b/usr.sbin/rtadvd/rtadvd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: rtadvd.c,v 1.23 2002/09/10 05:31:17 deraadt Exp $ */ +/* $OpenBSD: rtadvd.c,v 1.24 2003/03/14 18:33:58 itojun Exp $ */ /* $KAME: rtadvd.c,v 1.66 2002/05/29 14:18:36 itojun Exp $ */ /* @@ -1197,14 +1197,23 @@ nd6_options(struct nd_opt_hdr *hdr, int limit, int optlen = 0; for (; limit > 0; limit -= optlen) { + if (limit < sizeof(struct nd_opt_hdr *)) { + syslog(LOG_INFO, "<%s> short option header", __func__); + goto bad; + } + hdr = (struct nd_opt_hdr *)((caddr_t)hdr + optlen); - optlen = hdr->nd_opt_len << 3; if (hdr->nd_opt_len == 0) { syslog(LOG_ERR, "<%s> bad ND option length(0) (type = %d)", __func__, hdr->nd_opt_type); goto bad; } + optlen = hdr->nd_opt_len << 3; + if (optlen > limit) { + syslog(LOG_INFO, "<%s> short option", __func__); + goto bad; + } if (hdr->nd_opt_type > ND_OPT_MTU) { @@ -1219,10 +1228,24 @@ nd6_options(struct nd_opt_hdr *hdr, int limit, continue; } + /* + * Option length check. Do it here for all fixed-length + * options. + */ + if ((hdr->nd_opt_type == ND_OPT_MTU && + (optlen != sizeof(struct nd_opt_mtu))) || + ((hdr->nd_opt_type == ND_OPT_PREFIX_INFORMATION && + optlen != sizeof(struct nd_opt_prefix_info)))) { + syslog(LOG_INFO, "<%s> invalid option length", + __func__); + continue; + } + switch (hdr->nd_opt_type) { case ND_OPT_SOURCE_LINKADDR: case ND_OPT_TARGET_LINKADDR: case ND_OPT_REDIRECTED_HEADER: + break; /* we don't care about these options */ case ND_OPT_MTU: if (ndopts->nd_opt_array[hdr->nd_opt_type]) { syslog(LOG_INFO, |