[src/netbsd-1-6]: src/sys/netinet6 Pull up revision 1.24 (requested by itojun...

[lukem <lukem%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f01205b7bffb
branches:  netbsd-1-6
changeset: 529025:f01205b7bffb
user:      lukem <lukem%NetBSD.org@localhost>
date:      Thu Aug 22 00:00:09 2002 +0000

description:
Pull up revision 1.24 (requested by itojun in ticket #713):
check packet length before fetching ESP crypto checksum.  sync w/kame

diffstat:

 sys/netinet6/esp_input.c |  12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diffs (40 lines):

diff -r 9de123b26a8e -r f01205b7bffb sys/netinet6/esp_input.c
--- a/sys/netinet6/esp_input.c  Wed Aug 21 04:51:13 2002 +0000
+++ b/sys/netinet6/esp_input.c  Thu Aug 22 00:00:09 2002 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: esp_input.c,v 1.21 2002/03/18 15:30:03 itojun Exp $    */
+/*     $NetBSD: esp_input.c,v 1.21.6.1 2002/08/22 00:00:09 lukem Exp $ */
 /*     $KAME: esp_input.c,v 1.60 2001/09/04 08:43:19 itojun Exp $      */
 
 /*
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: esp_input.c,v 1.21 2002/03/18 15:30:03 itojun Exp $");
+__KERNEL_RCSID(0, "$NetBSD: esp_input.c,v 1.21.6.1 2002/08/22 00:00:09 lukem Exp $");
 
 #include "opt_inet.h"
 
@@ -216,6 +216,10 @@
        if (!sumalgo)
                goto noreplaycheck;
        siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1));
+       if (m->m_pkthdr.len < off + ESPMAXLEN + siz) {
+               ipsecstat.in_inval++;
+               goto bad;
+       }
        if (AH_MAXSUMSIZE < siz) {
                ipseclog((LOG_DEBUG,
                    "internal error: AH_MAXSUMSIZE must be larger than %lu\n",
@@ -630,6 +634,10 @@
        if (!sumalgo)
                goto noreplaycheck;
        siz = (((*sumalgo->sumsiz)(sav) + 3) & ~(4 - 1));
+       if (m->m_pkthdr.len < off + ESPMAXLEN + siz) {
+               ipsecstat.in_inval++;
+               goto bad;
+       }
        if (AH_MAXSUMSIZE < siz) {
                ipseclog((LOG_DEBUG,
                    "internal error: AH_MAXSUMSIZE must be larger than %lu\n",