[src/trunk]: src/sys/netinet6 always check extension header length.

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f40ec49b043e
branches:  trunk
changeset: 516751:f40ec49b043e
user:      itojun <itojun%NetBSD.org@localhost>
date:      Mon Oct 29 05:23:17 2001 +0000

description:
always check extension header length.

diffstat:

 sys/netinet6/ah_core.c |  13 ++++++++++---
 1 files changed, 10 insertions(+), 3 deletions(-)

diffs (30 lines):

diff -r 81fcf41bc41c -r f40ec49b043e sys/netinet6/ah_core.c
--- a/sys/netinet6/ah_core.c    Mon Oct 29 05:18:25 2001 +0000
+++ b/sys/netinet6/ah_core.c    Mon Oct 29 05:23:17 2001 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ah_core.c,v 1.24 2001/10/15 03:55:37 itojun Exp $      */
+/*     $NetBSD: ah_core.c,v 1.25 2001/10/29 05:23:17 itojun Exp $      */
 /*     $KAME: ah_core.c,v 1.45 2001/07/26 06:53:14 jinmei Exp $        */
 
 /*
@@ -1158,11 +1158,18 @@
                                        goto fail;
                                }
                                optlen = optp[1] + 2;
+                       }
 
-                               if (optp[0] & IP6OPT_MUTABLE)
-                                       bzero(optp + 2, optlen - 2);
+                       if (optp + optlen > optend) {
+                               error = EINVAL;
+                               m_free(n);
+                               n = NULL;
+                               goto fail;
                        }
 
+                       if (optp[0] & IP6OPT_MUTABLE)
+                               bzero(optp + 2, optlen - 2);
+
                        optp += optlen;
                }