diff options
| author |   dhartmei <dhartmei@openbsd.org> | 2003-01-25 19:47:05 +0000 |
|---|---|---|
| committer | dhartmei <dhartmei@openbsd.org> | 2003-01-25 19:47:05 +0000 |
| commit | 6328aa8fa721fe8aaddf5779bcf98341efd3b330 (patch) | |
| tree | 742cd97732d137bb4bd4b8131cdd9076e61a201b | |
| parent | Grr.. add a missing cdev_notdef() so that 35 really is the audio device (diff) | |
| download | wireguard-openbsd-6328aa8fa721fe8aaddf5779bcf98341efd3b330.tar.xz wireguard-openbsd-6328aa8fa721fe8aaddf5779bcf98341efd3b330.zip | |
Fix a bug that potentially caused fragments to be dropped when the
overlap calculation got negative. Found by Baruch Even. ok henning@
| -rw-r--r-- | sys/net/pf_norm.c | 17 |
1 files changed, 7 insertions, 10 deletions
diff --git a/sys/net/pf_norm.c b/sys/net/pf_norm.c index 894db02eb9b..9532eb0fad0 100644 --- a/sys/net/pf_norm.c +++ b/sys/net/pf_norm.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pf_norm.c,v 1.51 2003/01/09 15:58:35 dhartmei Exp $ */ +/* $OpenBSD: pf_norm.c,v 1.52 2003/01/25 19:47:05 dhartmei Exp $ */ /* * Copyright 2001 Niels Provos <provos@citi.umich.edu> @@ -364,20 +364,17 @@ pf_reassemble(struct mbuf **m0, struct pf_fragment *frag, KASSERT(frep != NULL || frea != NULL); - if (frep != NULL) { + if (frep != NULL && frep->fr_ip->ip_off + frep->fr_ip->ip_len > off) { u_int16_t precut; precut = frep->fr_ip->ip_off + frep->fr_ip->ip_len - off; if (precut >= ip->ip_len) goto drop_fragment; - if (precut) { - m_adj(frent->fr_m, precut); - - DPFPRINTF(("overlap -%d\n", precut)); - /* Enforce 8 byte boundaries */ - off = ip->ip_off += precut; - ip->ip_len -= precut; - } + m_adj(frent->fr_m, precut); + DPFPRINTF(("overlap -%d\n", precut)); + /* Enforce 8 byte boundaries */ + off = ip->ip_off += precut; + ip->ip_len -= precut; } for (; frea != NULL && ip->ip_len + off > frea->fr_ip->ip_off; |