From owner-cvs-all  Thu Mar  8 11: 3:34 2001
Delivered-To: cvs-all@freebsd.org
Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21])
	by hub.freebsd.org (Postfix) with ESMTP
	id 243DB37B719; Thu,  8 Mar 2001 11:03:27 -0800 (PST)
	(envelope-from iedowse@FreeBSD.org)
Received: (from iedowse@localhost)
	by freefall.freebsd.org (8.11.1/8.11.1) id f28J3Rp36712;
	Thu, 8 Mar 2001 11:03:27 -0800 (PST)
	(envelope-from iedowse)
Message-Id: <200103081903.f28J3Rp36712@freefall.freebsd.org>
From: Ian Dowse <iedowse@FreeBSD.org>
Date: Thu, 8 Mar 2001 11:03:27 -0800 (PST)
To: cvs-committers@FreeBSD.org, cvs-all@FreeBSD.org
Subject: cvs commit: src/sys/netinet ip_icmp.c ip_input.c
X-FreeBSD-CVS-Branch: HEAD
Sender: owner-cvs-all@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

iedowse     2001/03/08 11:03:26 PST

  Modified files:
    sys/netinet          ip_icmp.c ip_input.c 
  Log:
  It was possible for ip_forward() to supply to icmp_error()
  an IP header with ip_len in network byte order. For certain
  values of ip_len, this could cause icmp_error() to write
  beyond the end of an mbuf, causing mbuf free-list corruption.
  This problem was observed during generation of ICMP redirects.
  
  We now make quite sure that the copy of the IP header kept
  for icmp_error() is stored in a non-shared mbuf header so
  that it will not be modified by ip_output().
  
  Also:
  - Calculate the correct number of bytes that need to be
    retained for icmp_error(), instead of assuming that 64
    is enough (it's not).
  - In icmp_error(), use m_copydata instead of bcopy() to
    copy from the supplied mbuf chain, in case the first 8
    bytes of IP payload are not stored directly after the IP
    header.
  - Sanity-check ip_len in icmp_error(), and panic if it is
    less than sizeof(struct ip). Incoming packets with bad
    ip_len values are discarded in ip_input(), so this should
    only be triggered by bugs in the code, not by bad packets.
  
  This patch results from code and suggestions from Ruslan, Bosko,
  Jonathan Lemon and Matt Dillon, with important testing by Mike
  Tancsa, who could reproduce this problem at will.
  
  Reported by:	Mike Tancsa <mike@sentex.net>
  Reviewed by:	ru, bmilekic, jlemon, dillon
  
  Revision  Changes    Path
  1.54      +4 -2      src/sys/netinet/ip_icmp.c
  1.162     +16 -9     src/sys/netinet/ip_input.c


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe cvs-all" in the body of the message