Author: markj
Date: Tue Nov 13 17:25:34 2018
New Revision: 340397
URL: https://svnweb.freebsd.org/changeset/base/340397
Log:
MFC r340313:
Ensure that IP fragments do not extend beyond IP_MAXPACKET.
Approved by: re (gjb)
Modified:
stable/12/sys/netinet/ip_reass.c
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/sys/netinet/ip_reass.c
==============================================================================
--- stable/12/sys/netinet/ip_reass.c Tue Nov 13 16:51:30 2018
(r340396)
+++ stable/12/sys/netinet/ip_reass.c Tue Nov 13 17:25:34 2018
(r340397)
@@ -228,6 +228,16 @@ ip_reass(struct mbuf *m)
ip->ip_off = htons(ntohs(ip->ip_off) << 3);
/*
+ * Make sure the fragment lies within a packet of valid size.
+ */
+ if (ntohs(ip->ip_len) + ntohs(ip->ip_off) > IP_MAXPACKET) {
+ IPSTAT_INC(ips_toolong);
+ IPSTAT_INC(ips_fragdropped);
+ m_freem(m);
+ return (NULL);
+ }
+
+ /*
* Attempt reassembly; if it succeeds, proceed.
* ip_reass() will return a different mbuf.
*/
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
