CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/06 03:58:54
Modified files:
sbin/isakmpd : isakmp_cfg.c
Log message:
isakmpd: Bound the HASH coverage in cfg_verify_hash()
The verifier assumed the HASH payload is the first payload and
derived the covered length from the message length, reading past
the end of the message when another payload precedes HASH. Compute
the covered range from the HASH payload's actual position and reject
it if it extends past the message end.
from markus@, ok me deraadt@
