[src/trunk]: src/sys/netinet fix potential mbuf overflow, from Alexander Dani...

[plunky <plunky%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/4de8adea3de2
branches:  trunk
changeset: 759230:4de8adea3de2
user:      plunky <plunky%NetBSD.org@localhost>
date:      Thu Dec 02 19:07:27 2010 +0000

description:
fix potential mbuf overflow, from Alexander Danilov on tech-net

diffstat:

 sys/netinet/tcp_input.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (27 lines):

diff -r b88625fdb9df -r 4de8adea3de2 sys/netinet/tcp_input.c
--- a/sys/netinet/tcp_input.c   Thu Dec 02 18:02:58 2010 +0000
+++ b/sys/netinet/tcp_input.c   Thu Dec 02 19:07:27 2010 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: tcp_input.c,v 1.305 2010/05/26 17:38:29 bouyer Exp $   */
+/*     $NetBSD: tcp_input.c,v 1.306 2010/12/02 19:07:27 plunky Exp $   */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -145,7 +145,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.305 2010/05/26 17:38:29 bouyer Exp $");
+__KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.306 2010/12/02 19:07:27 plunky Exp $");
 
 #include "opt_inet.h"
 #include "opt_ipsec.h"
@@ -4274,7 +4274,7 @@
                return (ENOBUFS);
 #endif
        MGETHDR(m, M_DONTWAIT, MT_DATA);
-       if (m && tlen > MHLEN) {
+       if (m && (max_linkhdr + tlen) > MHLEN) {
                MCLGET(m, M_DONTWAIT);
                if ((m->m_flags & M_EXT) == 0) {
                        m_freem(m);