RTOS/rtems
1
0
Fork 0
forked from Imagelibrary/rtems
Code Pull Requests Activity

2005-05-20 Eric Norum <norume@aps.anl.gov>

Browse Source 
PR 793/networking
	* libnetworking/netinet/ip_icmp.c: Malicious ICMP packet causes panic.
	Just ignore it.
This commit is contained in:
Joel Sherrill
2005-05-20 18:56:42 +00:00
parent 4878568e39
commit 4e8c729f7f
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
cpukit/ChangeLog
View File

@@ -1,3 +1,9 @@
2005-05-20 Eric Norum <norume@aps.anl.gov>
PR 793/networking
* libnetworking/netinet/ip_icmp.c: Malicious ICMP packet causes panic.
Just ignore it.
2005-05-18 Chris Johns <chrisj@rtems.org> 2005-05-18 Chris Johns <chrisj@rtems.org>
* libmisc/capture/capture-cli.c: Fix the output of ctload when * libmisc/capture/capture-cli.c: Fix the output of ctload when

7
cpukit/libnetworking/netinet/ip_icmp.c
View File

@@ -138,6 +138,10 @@ icmp_error(n, type, code, dest, destifp)
/* Don't send error in response to a multicast or broadcast packet */ /* Don't send error in response to a multicast or broadcast packet */
if (n->m_flags & (M_BCAST|M_MCAST)) if (n->m_flags & (M_BCAST|M_MCAST))
goto freeit; goto freeit;
/* Don't send error in response to malicious packet */
icmplen = min(oiplen + 8, oip->ip_len);
if (icmplen < sizeof(struct ip))
goto freeit;
/* /*
* First, formulate icmp message * First, formulate icmp message
*/ */
@@ -147,9 +151,6 @@ icmp_error(n, type, code, dest, destifp)
#ifdef MAC #ifdef MAC
mac_create_mbuf_netlayer(n, m); mac_create_mbuf_netlayer(n, m);
#endif #endif
icmplen = min(oiplen + 8, oip->ip_len);
if (icmplen < sizeof(struct ip))
panic("icmp_error: bad length");
m->m_len = icmplen + ICMP_MINLEN; m->m_len = icmplen + ICMP_MINLEN;
MH_ALIGN(m, m->m_len); MH_ALIGN(m, m->m_len);
icp = mtod(m, struct icmp *); icp = mtod(m, struct icmp *);