Module Name:    src
Committed By:   maxv
Date:           Fri Feb 16 11:25:16 UTC 2018

Modified Files:
        src/sys/netipsec: ipsec.c

Log Message:
Fix inverted logic, otherwise the kernel crashes when receiving a 1-byte
AH packet. Triggerable before authentication when IPsec and forwarding
are both enabled.


To generate a diff of this commit:
cvs rdiff -u -r1.129 -r1.130 src/sys/netipsec/ipsec.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/sys/netipsec/ipsec.c
diff -u src/sys/netipsec/ipsec.c:1.129 src/sys/netipsec/ipsec.c:1.130
--- src/sys/netipsec/ipsec.c:1.129	Fri Feb 16 11:07:44 2018
+++ src/sys/netipsec/ipsec.c	Fri Feb 16 11:25:16 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: ipsec.c,v 1.129 2018/02/16 11:07:44 maxv Exp $ */
+/* $NetBSD: ipsec.c,v 1.130 2018/02/16 11:25:16 maxv Exp $ */
 /* $FreeBSD: src/sys/netipsec/ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $ */
 /* $KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $ */
 
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.129 2018/02/16 11:07:44 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.130 2018/02/16 11:25:16 maxv Exp $");
 
 /*
  * IPsec controller part.
@@ -1038,7 +1038,7 @@ ipsec4_get_ulp(struct mbuf *m, struct se
 			spidx->dst.sin.sin_port = uh.uh_dport;
 			return;
 		case IPPROTO_AH:
-			if (m->m_pkthdr.len > off + sizeof(ip6e))
+			if (off + sizeof(ip6e) > m->m_pkthdr.len)
 				goto done;
 			/* XXX sigh, this works but is totally bogus */
 			m_copydata(m, off, sizeof(ip6e), &ip6e);

Reply via email to