doc/share/security/patches/EN-18:13/icmp.patch
2018-11-27 20:00:28 +00:00

21 lines
691 B
Diff

--- sys/netinet/ip_icmp.c.orig
+++ sys/netinet/ip_icmp.c
@@ -310,7 +310,8 @@
#endif
icmplen = min(icmplen, M_TRAILINGSPACE(m) -
sizeof(struct ip) - ICMP_MINLEN);
- m_align(m, ICMP_MINLEN + icmplen);
+ m_align(m, sizeof(struct ip) + ICMP_MINLEN + icmplen);
+ m->m_data += sizeof(struct ip);
m->m_len = ICMP_MINLEN + icmplen;
/* XXX MRT make the outgoing packet use the same FIB
@@ -352,6 +353,8 @@
* reply should bypass as well.
*/
m->m_flags |= n->m_flags & M_SKIP_FIREWALL;
+ KASSERT(M_LEADINGSPACE(m) >= sizeof(struct ip),
+ ("insufficient space for ip header"));
m->m_data -= sizeof(struct ip);
m->m_len += sizeof(struct ip);
m->m_pkthdr.len = m->m_len;