[src/netbsd-2-0]: src/doc tickets 11393, 11395

[bouyer <bouyer%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/e35cc992ecfc
branches:  netbsd-2-0
changeset: 565074:e35cc992ecfc
user:      bouyer <bouyer%NetBSD.org@localhost>
date:      Sat Dec 01 17:34:38 2007 +0000

description:
tickets 11393, 11395

diffstat:

 doc/CHANGES-2.0.4 |  25 ++++++++++++++++++++++++-
 1 files changed, 24 insertions(+), 1 deletions(-)

diffs (36 lines):

diff -r c1afe0f49a27 -r e35cc992ecfc doc/CHANGES-2.0.4
--- a/doc/CHANGES-2.0.4 Sat Dec 01 17:33:14 2007 +0000
+++ b/doc/CHANGES-2.0.4 Sat Dec 01 17:34:38 2007 +0000
@@ -1,4 +1,4 @@
-#      $NetBSD: CHANGES-2.0.4,v 1.1.2.79 2007/11/19 20:34:08 bouyer Exp $
+#      $NetBSD: CHANGES-2.0.4,v 1.1.2.80 2007/12/01 17:34:38 bouyer Exp $
 
 A complete list of changes from the NetBSD 2.0.3 update to the NetBSD 2.0.4
 update.
@@ -689,3 +689,26 @@
        heap corruption. This will hopefully fix PR bin/37236.
        [tron, ticket #11390]
 
+sys/netinet6/ipcomp_input.c                    1.28
+
+       From FreeBSD:
+           In ipcomp6_input(), check 'md' not 'm' after a call to
+           m_pulldown(): 'm' may be a stale pointer at this point, and
+           we're interested in whether or not m_pulldown() failed.
+           Noticed by:     Coverity Prevent analysis tool
+       [jdc, ticket #11393]
+
+sys/netipsec/ipsec.c                           1.34 via patch
+sys/netipsec/ipsec_osdep.h                     1.21 via patch
+sys/netipsec/ipsec_output.c                    1.23 via patch
+sys/netipsec/xform_ah.c                                1.19 via patch
+sys/netipsec/xform_ipip.c                      1.18 via patch
+
+       The function ipsec4_get_ulp assumes that ip_off is in host order.
+       This results in IPsec processing that is dependent on protocol
+       and/or port can be bypassed.
+
+       Bug report, analysis and initial fix from Karl Knutsson.
+       Final patch and ok from degroote@
+       [adrianp, ticket #11395]
+