diff options
| author |   deraadt <deraadt@openbsd.org> | 2009-10-28 18:02:00 +0000 |
|---|---|---|
| committer | deraadt <deraadt@openbsd.org> | 2009-10-28 18:02:00 +0000 |
| commit | f1b54a7b5c738df7fca55606dd9af4deeaec22c5 (patch) | |
| tree | 87dd9ba5826eeb40cdc67b563eced95a9dab832d | |
| parent | For the TIOCSET* ioctls, validate that the tty speeds are positive (since (diff) | |
| download | wireguard-openbsd-f1b54a7b5c738df7fca55606dd9af4deeaec22c5.tar.xz wireguard-openbsd-f1b54a7b5c738df7fca55606dd9af4deeaec22c5.zip | |
*NULL store in IP_AUTH_LEVEL, IP_ESP_TRANS_LEVEL, IP_ESP_NETWORK_LEVEL,
IP_IPCOMP_LEVEL found by Clement LECIGNE, localhost root exploitable on
userland/kernel shared vm machines (ie. i386, amd64, arm, sparc (but not
sparc64), sh, ...) on OpenBSD 4.3 or older
ok claudio
| -rw-r--r-- | sys/netinet/ip_output.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index b59ffcaaf2d..22e96f50d57 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip_output.c,v 1.195 2009/10/06 21:21:48 claudio Exp $ */ +/* $OpenBSD: ip_output.c,v 1.196 2009/10/28 18:02:00 deraadt Exp $ */ /* $NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $ */ /* @@ -1526,6 +1526,7 @@ ip_ctloutput(op, so, level, optname, mp) case IP_ESP_TRANS_LEVEL: case IP_ESP_NETWORK_LEVEL: case IP_IPCOMP_LEVEL: + *mp = m = m_get(M_WAIT, MT_SOOPTS); #ifndef IPSEC m->m_len = sizeof(int); *mtod(m, int *) = IPSEC_LEVEL_NONE; |