From owner-freebsd-bugs@FreeBSD.ORG Thu Apr 19 15:50:10 2007 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id D19F216A406 for ; Thu, 19 Apr 2007 15:50:10 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40]) by mx1.freebsd.org (Postfix) with ESMTP id 8D3C713C45A for ; Thu, 19 Apr 2007 15:50:10 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id l3JFoAWj013751 for ; Thu, 19 Apr 2007 15:50:10 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id l3JFoAG8013750; Thu, 19 Apr 2007 15:50:10 GMT (envelope-from gnats) Date: Thu, 19 Apr 2007 15:50:10 GMT Message-Id: <200704191550.l3JFoAG8013750@freefall.freebsd.org> To: freebsd-bugs@FreeBSD.org From: dfilter@FreeBSD.ORG (dfilter service) Cc: Subject: Re: kern/99425: commit references a PR X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: dfilter service List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Apr 2007 15:50:10 -0000 The following reply was made to PR kern/99425; it has been noted by GNATS. From: dfilter@FreeBSD.ORG (dfilter service) To: bug-followup@FreeBSD.org Cc: Subject: Re: kern/99425: commit references a PR Date: Thu, 19 Apr 2007 15:41:10 +0000 (UTC) mtm 2007-04-19 15:41:00 UTC FreeBSD src repository Modified files: sbin/ping6 ping6.c Log: Correct two issues in ping6: 1. The static buffer that ping6(8) uses to hold the control data it gets from recvmsg(2) is too small in some cases. 2. When it prints the extra header information it doesn't do any checking to make sure the data it's printing is within the bounds of the supplied buffer. Fix this by: o Increasing the buffer to hold extra headers to 10240 bytes (the minimum according to RFC3542 sec. 20.1) and allocate it dynamically. o In verbose mode, specify a warning if any control data from recvmsg(2) was truncated because the buffer was too small. o When printing the extra headers make sure not to overrun the buffer boundaries. Reviewed By: mlaier PR: kern/99425 MFC After: 1 month Revision Changes Path 1.30 +68 -19 src/sbin/ping6/ping6.c _______________________________________________ cvs-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/cvs-all To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"