[src/netbsd-2-1]: src/doc tickets 11393, 11395

[bouyer <bouyer%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/ae07d47242d9
branches:  netbsd-2-1
changeset: 564291:ae07d47242d9
user:      bouyer <bouyer%NetBSD.org@localhost>
date:      Sat Dec 01 17:34:50 2007 +0000

description:
tickets 11393, 11395

diffstat:

 doc/CHANGES-2.1.1 |  25 ++++++++++++++++++++++++-
 1 files changed, 24 insertions(+), 1 deletions(-)

diffs (36 lines):

diff -r f1f409d6bdc2 -r ae07d47242d9 doc/CHANGES-2.1.1
--- a/doc/CHANGES-2.1.1 Sat Dec 01 17:32:28 2007 +0000
+++ b/doc/CHANGES-2.1.1 Sat Dec 01 17:34:50 2007 +0000
@@ -1,4 +1,4 @@
-#      $NetBSD: CHANGES-2.1.1,v 1.1.2.81 2007/11/19 20:35:03 bouyer Exp $
+#      $NetBSD: CHANGES-2.1.1,v 1.1.2.82 2007/12/01 17:34:50 bouyer Exp $
 
 A complete list of changes from the NetBSD 2.1 release to the NetBSD 2.1.1
 release
@@ -766,3 +766,26 @@
        heap corruption. This will hopefully fix PR bin/37236.
        [tron, ticket #11390]
 
+sys/netinet6/ipcomp_input.c                    1.28
+
+       From FreeBSD:
+           In ipcomp6_input(), check 'md' not 'm' after a call to
+           m_pulldown(): 'm' may be a stale pointer at this point, and
+           we're interested in whether or not m_pulldown() failed.
+           Noticed by:     Coverity Prevent analysis tool
+       [jdc, ticket #11393]
+
+sys/netipsec/ipsec.c                           1.34 via patch
+sys/netipsec/ipsec_osdep.h                     1.21 via patch
+sys/netipsec/ipsec_output.c                    1.23 via patch
+sys/netipsec/xform_ah.c                                1.19 via patch
+sys/netipsec/xform_ipip.c                      1.18 via patch
+
+       The function ipsec4_get_ulp assumes that ip_off is in host order.
+       This results in IPsec processing that is dependent on protocol
+       and/or port can be bypassed.
+
+       Bug report, analysis and initial fix from Karl Knutsson.
+       Final patch and ok from degroote@
+       [adrianp, ticket #11395]
+