989d921f5d
I'm very pleased to announce the release of our new website and documentation using the new toolchain with Hugo and AsciiDoctor. To get more information about the new toolchain please read the FreeBSD Documentation Project Primer[1], Hugo docs[2] and AsciiDoctor docs[3]. Acknowledgment: Benedict Reuschling <bcr@> Glen Barber <gjb@> Hiroki Sato <hrs@> Li-Wen Hsu <lwhsu@> Sean Chittenden <seanc@> The FreeBSD Foundation [1] https://docs.FreeBSD.org/en/books/fdp-primer/ [2] https://gohugo.io/documentation/ [3] https://docs.asciidoctor.org/home/ Approved by: doceng, core
32 lines
1.1 KiB
Diff
32 lines
1.1 KiB
Diff
Index: sys/netinet/igmp.c
|
|
===================================================================
|
|
--- sys/netinet/igmp.c (revision 280920)
|
|
+++ sys/netinet/igmp.c (working copy)
|
|
@@ -1534,7 +1534,6 @@ igmp_input(struct mbuf *m, int off)
|
|
struct igmpv3 *igmpv3;
|
|
uint16_t igmpv3len;
|
|
uint16_t nsrc;
|
|
- int srclen;
|
|
|
|
IGMPSTAT_INC(igps_rcv_v3_queries);
|
|
igmpv3 = (struct igmpv3 *)igmp;
|
|
@@ -1542,8 +1541,8 @@ igmp_input(struct mbuf *m, int off)
|
|
* Validate length based on source count.
|
|
*/
|
|
nsrc = ntohs(igmpv3->igmp_numsrc);
|
|
- srclen = sizeof(struct in_addr) * nsrc;
|
|
- if (nsrc * sizeof(in_addr_t) > srclen) {
|
|
+ if (nsrc * sizeof(in_addr_t) >
|
|
+ UINT16_MAX - iphlen - IGMP_V3_QUERY_MINLEN) {
|
|
IGMPSTAT_INC(igps_rcv_tooshort);
|
|
return;
|
|
}
|
|
@@ -1552,7 +1551,7 @@ igmp_input(struct mbuf *m, int off)
|
|
* this scope.
|
|
*/
|
|
igmpv3len = iphlen + IGMP_V3_QUERY_MINLEN +
|
|
- srclen;
|
|
+ sizeof(struct in_addr) * nsrc;
|
|
if ((m->m_flags & M_EXT ||
|
|
m->m_len < igmpv3len) &&
|
|
(m = m_pullup(m, igmpv3len)) == NULL) {
|