diff options
| author |   mpi <mpi@openbsd.org> | 2020-05-06 07:08:53 +0000 |
|---|---|---|
| committer | mpi <mpi@openbsd.org> | 2020-05-06 07:08:53 +0000 |
| commit | 574b3a4fa98da815e768e03fe0bc92c34e9a638c (patch) | |
| tree | b5444751a02a1650e47b11c482d81411d6bbf4a6 /sys/kern | |
| parent | Purge the ic_bss->ni_savedq mbuf queue when a wireless interface goes down. (diff) | |
| download | wireguard-openbsd-574b3a4fa98da815e768e03fe0bc92c34e9a638c.tar.xz wireguard-openbsd-574b3a4fa98da815e768e03fe0bc92c34e9a638c.zip | |
Do sanity checks in ip6_pullexthdr() preventing a panic in m_copydata(9).
An invalid/corrupted hop6 option in rip6_input()/ip6_savecontrol() could
lead m_copydata(9)s' check to trigger a panic.
Fix from maxv@NetBSD where the problem was also reported by syzkaller.
Reported-by: syzbot+3b07b3511b4ceb8bf1e2@syzkaller.appspotmail.com
Reported-by: syzbot+7ee0eb2691d507fcad2e@syzkaller.appspotmail.com
ok sashan@, dlg@, claudio@, deraadt@
Diffstat (limited to 'sys/kern')
0 files changed, 0 insertions, 0 deletions