32 lines
1.1 KiB
Diff
32 lines
1.1 KiB
Diff
Index: sys/netinet/igmp.c
|
|
===================================================================
|
|
--- sys/netinet/igmp.c (revision 280920)
|
|
+++ sys/netinet/igmp.c (working copy)
|
|
@@ -1534,7 +1534,6 @@ igmp_input(struct mbuf *m, int off)
|
|
struct igmpv3 *igmpv3;
|
|
uint16_t igmpv3len;
|
|
uint16_t nsrc;
|
|
- int srclen;
|
|
|
|
IGMPSTAT_INC(igps_rcv_v3_queries);
|
|
igmpv3 = (struct igmpv3 *)igmp;
|
|
@@ -1542,8 +1541,8 @@ igmp_input(struct mbuf *m, int off)
|
|
* Validate length based on source count.
|
|
*/
|
|
nsrc = ntohs(igmpv3->igmp_numsrc);
|
|
- srclen = sizeof(struct in_addr) * nsrc;
|
|
- if (nsrc * sizeof(in_addr_t) > srclen) {
|
|
+ if (nsrc * sizeof(in_addr_t) >
|
|
+ UINT16_MAX - iphlen - IGMP_V3_QUERY_MINLEN) {
|
|
IGMPSTAT_INC(igps_rcv_tooshort);
|
|
return;
|
|
}
|
|
@@ -1552,7 +1551,7 @@ igmp_input(struct mbuf *m, int off)
|
|
* this scope.
|
|
*/
|
|
igmpv3len = iphlen + IGMP_V3_QUERY_MINLEN +
|
|
- srclen;
|
|
+ sizeof(struct in_addr) * nsrc;
|
|
if ((m->m_flags & M_EXT ||
|
|
m->m_len < igmpv3len) &&
|
|
(m = m_pullup(m, igmpv3len)) == NULL) {
|