diff options
| author | SUZUKI Shinsuke <suz@FreeBSD.org> | 2006-03-23 14:39:38 +0000 |
|---|---|---|
| committer | SUZUKI Shinsuke <suz@FreeBSD.org> | 2006-03-23 14:39:38 +0000 |
| commit | 94182c08be73e712f6e48aced53d80e78a6e2ded (patch) | |
| tree | f9bab8a7bdd603e7a4153e739e46ef58c206540d /usr.sbin/rtadvd | |
| parent | ed440ef6e41316d133fb0e6c6b2500e7a4f34479 (diff) | |
| download | src-94182c08be73e712f6e48aced53d80e78a6e2ded.tar.gz src-94182c08be73e712f6e48aced53d80e78a6e2ded.zip | |
avoid heap overrun
Obtained from: KAME
MFC after: 1 day
Notes
Notes:
svn path=/head/; revision=157047
Diffstat (limited to 'usr.sbin/rtadvd')
| -rw-r--r-- | usr.sbin/rtadvd/config.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/usr.sbin/rtadvd/config.c b/usr.sbin/rtadvd/config.c index 000cd3a610f3..4682e9843da9 100644 --- a/usr.sbin/rtadvd/config.c +++ b/usr.sbin/rtadvd/config.c @@ -656,7 +656,7 @@ get_prefix(struct rainfo *rai) memcpy(&pp->prefix, a, sizeof(*a)); p = (u_char *)&pp->prefix; ep = (u_char *)(&pp->prefix + 1); - while (m < lim) + while (m < lim && p < ep) *p++ &= *m++; while (p < ep) *p++ = 0x00; |