[src/trunk]: src/sys/netinet6 be more more picky about option length parsing....

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/6867dc3ca126
branches:  trunk
changeset: 504109:6867dc3ca126
user:      itojun <itojun%NetBSD.org@localhost>
date:      Thu Feb 22 01:40:25 2001 +0000

description:
be more more picky about option length parsing.  sync with kame

diffstat:

 sys/netinet6/dest6.c |  7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diffs (21 lines):

diff -r c6e0caef263d -r 6867dc3ca126 sys/netinet6/dest6.c
--- a/sys/netinet6/dest6.c      Thu Feb 22 01:02:09 2001 +0000
+++ b/sys/netinet6/dest6.c      Thu Feb 22 01:40:25 2001 +0000
@@ -1,5 +1,5 @@
-/*     $NetBSD: dest6.c,v 1.9 2001/02/21 17:23:09 itojun Exp $ */
-/*     $KAME: dest6.c,v 1.24 2001/02/21 16:12:35 itojun Exp $  */
+/*     $NetBSD: dest6.c,v 1.10 2001/02/22 01:40:25 itojun Exp $        */
+/*     $KAME: dest6.c,v 1.25 2001/02/22 01:39:16 itojun Exp $  */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -89,7 +89,8 @@
 
        /* search header for all options. */
        for (optlen = 0; dstoptlen > 0; dstoptlen -= optlen, opt += optlen) {
-               if (*opt != IP6OPT_PAD1 && dstoptlen < IP6OPT_MINLEN) {
+               if (*opt != IP6OPT_PAD1 &&
+                   (dstoptlen < IP6OPT_MINLEN || *(opt + 1) + 2 > dstoptlen)) {
                        ip6stat.ip6s_toosmall++;
                        goto bad;
                }