doc/share/security/patches/SA-19:22/mbuf.patch
2019-08-20 18:45:04 +00:00

11 lines
344 B
Diff

--- sys/kern/uipc_mbuf2.c.orig
+++ sys/kern/uipc_mbuf2.c
@@ -216,7 +216,7 @@
goto ok;
}
if ((off == 0 || offp) && M_LEADINGSPACE(n->m_next) >= hlen
- && writable) {
+ && writable && n->m_next->m_len >= tlen) {
n->m_next->m_data -= hlen;
n->m_next->m_len += hlen;
bcopy(mtod(n, caddr_t) + off, mtod(n->m_next, caddr_t), hlen);