https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=194439
Bug ID: 194439
Summary: mld_v1_transmit_report corrupts memory
Product: Base System
Version: 11.0-CURRENT
Hardware: Any
OS: Any
Status: Needs Triage
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: [email protected]
Reporter: [email protected]
The "MH_ALIGN(mh, sizeof(struct ip6_hdr));" in mld_v1_transmit_report should be
"MH_ALIGN(mh, sizeof(struct ip6_hdr)+sizeof(struct mld_hdr));".
The current code will always walk off the end of the buffer and corrupt
whatever memory follows.
It's a good thing that mldv2 is widely supported :-)
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "[email protected]"
