[src/netbsd-3]: src/crypto/dist/ipsec-tools/src/racoon Pull up revision 1.2 (...

[tron <tron%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/47d4069ae1e2
branches:  netbsd-3
changeset: 575128:47d4069ae1e2
user:      tron <tron%NetBSD.org@localhost>
date:      Wed Apr 06 10:48:50 2005 +0000

description:
Pull up revision 1.2 (requested by manu in ticket #111):
Fix a buffer overrun in ISAKMP mode config SET handler

diffstat:

 crypto/dist/ipsec-tools/src/racoon/isakmp_cfg.c |  4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diffs (18 lines):

diff -r 8fbe7c041c81 -r 47d4069ae1e2 crypto/dist/ipsec-tools/src/racoon/isakmp_cfg.c
--- a/crypto/dist/ipsec-tools/src/racoon/isakmp_cfg.c   Tue Apr 05 11:04:41 2005 +0000
+++ b/crypto/dist/ipsec-tools/src/racoon/isakmp_cfg.c   Wed Apr 06 10:48:50 2005 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: isakmp_cfg.c,v 1.1.1.3 2005/03/16 23:52:42 manu Exp $  */
+/*     $NetBSD: isakmp_cfg.c,v 1.1.1.3.2.1 2005/04/06 10:48:50 tron Exp $      */
 
 /* Id: isakmp_cfg.c,v 1.26.2.1 2005/03/16 00:13:38 manubsd Exp */
 
@@ -637,7 +637,7 @@
                        attr++;
                } else {
                        alen = ntohs(attr->lorv);
-                       tlen -= alen;
+                       tlen -= (sizeof(*attr) + alen);
                        npp = (char *)attr;
                        attr = (struct isakmp_data *)
                            (npp + sizeof(*attr) + alen);