[src/trunk]: src/sys/net repair validation on RTAX_GENMASK insertion. has be...

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/15d6b3e42dab
branches:  trunk
changeset: 513012:15d6b3e42dab
user:      itojun <itojun%NetBSD.org@localhost>
date:      Sat Jul 21 12:20:36 2001 +0000

description:
repair validation on RTAX_GENMASK insertion.  has been broken since 44bsd.
(freebsd3 has a fix since 1999, but has insufficient validation on sa_len)

diffstat:

 sys/net/rtsock.c |  6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diffs (20 lines):

diff -r 8bfe2ea0142f -r 15d6b3e42dab sys/net/rtsock.c
--- a/sys/net/rtsock.c  Sat Jul 21 06:01:03 2001 +0000
+++ b/sys/net/rtsock.c  Sat Jul 21 12:20:36 2001 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: rtsock.c,v 1.49 2001/07/19 00:12:09 enami Exp $        */
+/*     $NetBSD: rtsock.c,v 1.50 2001/07/21 12:20:36 itojun Exp $       */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -257,7 +257,9 @@
        if (genmask) {
                struct radix_node *t;
                t = rn_addmask((caddr_t)genmask, 0, 1);
-               if (t && Bcmp(genmask, t->rn_key, *(u_char *)genmask) == 0)
+               if (t && genmask->sa_len >= ((struct sockaddr *)t->rn_key)->sa_len &&
+                   Bcmp((caddr_t *)genmask + 1, (caddr_t *)t->rn_key + 1,
+                   ((struct sockaddr *)t->rn_key)->sa_len) - 1)
                        genmask = (struct sockaddr *)(t->rn_key);
                else
                        senderr(ENOBUFS);