[src/trunk]: src/sys/netipsec Strengthen this check, to make sure there is ro...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/93e77ee53910
branches:  trunk
changeset: 359696:93e77ee53910
user:      maxv <maxv%NetBSD.org@localhost>
date:      Wed Feb 21 16:55:53 2018 +0000

description:
Strengthen this check, to make sure there is room for an ip6_ext structure.
Seems possible to crash m_copydata here (but I didn't test more than that).

diffstat:

 sys/netipsec/ipsec_output.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (27 lines):

diff -r 25d15c175878 -r 93e77ee53910 sys/netipsec/ipsec_output.c
--- a/sys/netipsec/ipsec_output.c       Wed Feb 21 16:48:28 2018 +0000
+++ b/sys/netipsec/ipsec_output.c       Wed Feb 21 16:55:53 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ipsec_output.c,v 1.66 2018/02/08 20:57:41 maxv Exp $   */
+/*     $NetBSD: ipsec_output.c,v 1.67 2018/02/21 16:55:53 maxv Exp $   */
 
 /*-
  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
@@ -29,7 +29,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.66 2018/02/08 20:57:41 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec_output.c,v 1.67 2018/02/21 16:55:53 maxv Exp $");
 
 /*
  * IPsec output processing.
@@ -696,7 +696,7 @@
                default:
                        return;
                }
-       } while (*i < m->m_pkthdr.len);
+       } while (*i + sizeof(ip6e) < m->m_pkthdr.len);
 }
 
 static int