Date: Fri, 21 May 2004 15:06:56 -0700 (PDT) From: Zhenmin <zli4@cs.uiuc.edu> To: freebsd-gnats-submit@FreeBSD.org Subject: misc/67013: A potential bug detected in /sys/netipsec/key.c Message-ID: <200405212206.i4LM6ut0076906@www.freebsd.org> Resent-Message-ID: <200405212210.i4LMAOHC030253@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 67013
>Category: misc
>Synopsis: A potential bug detected in /sys/netipsec/key.c
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Fri May 21 15:10:23 PDT 2004
>Closed-Date:
>Last-Modified:
>Originator: Zhenmin
>Release: 5.2.1
>Organization:
OPERA Research Group, UIUC
>Environment:
>Description:
The potential bug is detected by our analysis tool in file
/sys/netipsec/key.c:3849
3849 if (spidx0->src.sin6.sin6_scope_id &&
3850 spidx1->src.sin6.sin6_scope_id &&
3851 spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id)
3852 return 0;
3853 if (!key_bbcmp(&spidx0->dst.sin6.sin6_addr,
3854 &spidx1->dst.sin6.sin6_addr, spidx0->prefd))
3855 return 0;
>How-To-Repeat:
The potential bug is detected by our own analysis tool.
>Fix:
--- ./bsd-5.2.1/sys/netipsec/key.c 2003-09-29 17:57:43.000000000 -0500
+++ ./bsd-5.2.1/sys/netipsec/key.c.fixed 2004-05-21 17:01:05.000000000 -0500
@@ -3846,8 +3846,8 @@
* scope_id check. if sin6_scope_id is 0, we regard it
* as a wildcard scope, which matches any scope zone ID.
*/
- if (spidx0->src.sin6.sin6_scope_id &&
- spidx1->src.sin6.sin6_scope_id &&
+ if (spidx0->dst.sin6.sin6_scope_id &&
+ spidx1->dst.sin6.sin6_scope_id &&
spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id)
return 0;
if (!key_bbcmp(&spidx0->dst.sin6.sin6_addr,
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200405212206.i4LM6ut0076906>