diff options
| -rw-r--r-- | sys/netinet6/ip6_input.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys/netinet6/ip6_input.c b/sys/netinet6/ip6_input.c index d2dd44d14f8..381b5a088f7 100644 --- a/sys/netinet6/ip6_input.c +++ b/sys/netinet6/ip6_input.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip6_input.c,v 1.33 2001/09/15 03:54:40 frantzen Exp $ */ +/* $OpenBSD: ip6_input.c,v 1.34 2001/11/02 09:01:29 itojun Exp $ */ /* $KAME: ip6_input.c,v 1.188 2001/03/29 05:34:31 itojun Exp $ */ /* @@ -1347,6 +1347,8 @@ ip6_nexthdr(m, off, proto, nxtp) if (nxtp) *nxtp = ip6e.ip6e_nxt; off += (ip6e.ip6e_len + 2) << 2; + if (m->m_pkthdr.len < off) + return -1; return off; case IPPROTO_HOPOPTS: @@ -1358,6 +1360,8 @@ ip6_nexthdr(m, off, proto, nxtp) if (nxtp) *nxtp = ip6e.ip6e_nxt; off += (ip6e.ip6e_len + 1) << 3; + if (m->m_pkthdr.len < off) + return -1; return off; case IPPROTO_NONE: |