diff options
| author | Hajimu UMEMOTO <ume@FreeBSD.org> | 2007-01-16 15:55:29 +0000 |
|---|---|---|
| committer | Hajimu UMEMOTO <ume@FreeBSD.org> | 2007-01-16 15:55:29 +0000 |
| commit | 6a550ab34bc6157ba0e0e385989f1caaea5a68b6 (patch) | |
| tree | 17840d3427ece06c7424f6a4972edb6642c31165 | |
| parent | e9f0620b9faa632e5fb2bc226a93fcd9f724c562 (diff) | |
| download | src-6a550ab34bc6157ba0e0e385989f1caaea5a68b6.tar.gz src-6a550ab34bc6157ba0e0e385989f1caaea5a68b6.zip | |
Avoid infinite loop if nicmp6 and nip6 are not on the same mbuf.
NetBSD PR 34994+35333
MFC after: 3 days
Notes
Notes:
svn path=/head/; revision=166046
| -rw-r--r-- | sys/netinet6/icmp6.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c index 9ab07411820c..d2cb1b761973 100644 --- a/sys/netinet6/icmp6.c +++ b/sys/netinet6/icmp6.c @@ -588,7 +588,8 @@ icmp6_input(mp, offp, proto) n->m_next = n0; } else { nip6 = mtod(n, struct ip6_hdr *); - nicmp6 = (struct icmp6_hdr *)((caddr_t)nip6 + off); + IP6_EXTHDR_GET(nicmp6, struct icmp6_hdr *, n, off, + sizeof(*nicmp6)); noff = off; } nicmp6->icmp6_type = ICMP6_ECHO_REPLY; |