diff options
| author |   claudio <claudio@openbsd.org> | 2015-02-11 05:48:53 +0000 |
|---|---|---|
| committer | claudio <claudio@openbsd.org> | 2015-02-11 05:48:53 +0000 |
| commit | be47b2192befd3affcf9fc7c4dde5e31a3d82e15 (patch) | |
| tree | 00c8c84cb2a7b034f3404ffc6341a50dcfdc3fcf | |
| parent | Direct config glue for octdwctwo(4). (diff) | |
| download | wireguard-openbsd-be47b2192befd3affcf9fc7c4dde5e31a3d82e15.tar.xz wireguard-openbsd-be47b2192befd3affcf9fc7c4dde5e31a3d82e15.zip | |
Use sizeof(u_short) in the first check since there are RT messages that
are less then sizeof(*rtm) bytes long (e.g. interface announcements).
Found the hard way by phessler@
| -rw-r--r-- | usr.sbin/bgpd/kroute.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/usr.sbin/bgpd/kroute.c b/usr.sbin/bgpd/kroute.c index b309656fc15..99060908ec3 100644 --- a/usr.sbin/bgpd/kroute.c +++ b/usr.sbin/bgpd/kroute.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kroute.c,v 1.201 2015/02/10 05:18:39 claudio Exp $ */ +/* $OpenBSD: kroute.c,v 1.202 2015/02/11 05:48:53 claudio Exp $ */ /* * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> @@ -3038,7 +3038,7 @@ dispatch_rtmsg(void) lim = buf + n; for (next = buf; next < lim; next += rtm->rtm_msglen) { rtm = (struct rt_msghdr *)next; - if (lim < next + sizeof(*rtm) || + if (lim < next + sizeof(u_short) || lim < next + rtm->rtm_msglen) fatalx("dispatch_rtmsg: partial rtm in buffer"); if (rtm->rtm_version != RTM_VERSION) |