Module Name: src
Committed By: mlelstv
Date: Sat Jan 22 18:26:36 UTC 2011
Modified Files:
src/sys/netinet6: frag6.c
Log Message:
When deleting a fragment header use the simple copy operation only if it fits
completely into the mbuf.
To generate a diff of this commit:
cvs rdiff -u -r1.47 -r1.48 src/sys/netinet6/frag6.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/netinet6/frag6.c
diff -u src/sys/netinet6/frag6.c:1.47 src/sys/netinet6/frag6.c:1.48
--- src/sys/netinet6/frag6.c:1.47 Wed Mar 18 16:00:22 2009
+++ src/sys/netinet6/frag6.c Sat Jan 22 18:26:36 2011
@@ -1,4 +1,4 @@
-/* $NetBSD: frag6.c,v 1.47 2009/03/18 16:00:22 cegger Exp $ */
+/* $NetBSD: frag6.c,v 1.48 2011/01/22 18:26:36 mlelstv Exp $ */
/* $KAME: frag6.c,v 1.40 2002/05/27 21:40:31 itojun Exp $ */
/*
@@ -31,7 +31,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: frag6.c,v 1.47 2009/03/18 16:00:22 cegger Exp $");
+__KERNEL_RCSID(0, "$NetBSD: frag6.c,v 1.48 2011/01/22 18:26:36 mlelstv Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -517,7 +517,7 @@
/*
* Delete frag6 header with as a few cost as possible.
*/
- if (offset < m->m_len) {
+ if (m->m_len >= offset + sizeof(struct ip6_frag)) {
memmove((char *)ip6 + sizeof(struct ip6_frag), ip6, offset);
m->m_data += sizeof(struct ip6_frag);
m->m_len -= sizeof(struct ip6_frag);
