[src/trunk]: src/crypto/dist/ipsec-tools/src/racoon Fix a buffer overrun in I...

[manu <manu%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/53a4b56abe3b
branches:  trunk
changeset: 580016:53a4b56abe3b
user:      manu <manu%NetBSD.org@localhost>
date:      Mon Apr 04 21:43:26 2005 +0000

description:
Fix a buffer overrun in ISAKMP mode config SET handler

diffstat:

 crypto/dist/ipsec-tools/src/racoon/isakmp_cfg.c |  4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diffs (18 lines):

diff -r da83b9fced33 -r 53a4b56abe3b crypto/dist/ipsec-tools/src/racoon/isakmp_cfg.c
--- a/crypto/dist/ipsec-tools/src/racoon/isakmp_cfg.c   Mon Apr 04 20:38:24 2005 +0000
+++ b/crypto/dist/ipsec-tools/src/racoon/isakmp_cfg.c   Mon Apr 04 21:43:26 2005 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: isakmp_cfg.c,v 1.1.1.3 2005/03/16 23:52:42 manu Exp $  */
+/*     $NetBSD: isakmp_cfg.c,v 1.2 2005/04/04 21:43:26 manu Exp $      */
 
 /* Id: isakmp_cfg.c,v 1.26.2.1 2005/03/16 00:13:38 manubsd Exp */
 
@@ -637,7 +637,7 @@
                        attr++;
                } else {
                        alen = ntohs(attr->lorv);
-                       tlen -= alen;
+                       tlen -= (sizeof(*attr) + alen);
                        npp = (char *)attr;
                        attr = (struct isakmp_data *)
                            (npp + sizeof(*attr) + alen);