From owner-freebsd-bugs@FreeBSD.ORG Fri May 21 15:10:29 2004 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B237716A4CE for ; Fri, 21 May 2004 15:10:29 -0700 (PDT) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 912D043D31 for ; Fri, 21 May 2004 15:10:29 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) i4LMAO46030254 for ; Fri, 21 May 2004 15:10:24 -0700 (PDT) (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.12.11/8.12.11/Submit) id i4LMAOHC030253; Fri, 21 May 2004 15:10:24 -0700 (PDT) (envelope-from gnats) Resent-Date: Fri, 21 May 2004 15:10:24 -0700 (PDT) Resent-Message-Id: <200405212210.i4LMAOHC030253@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Zhenmin Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2909216A4CE for ; Fri, 21 May 2004 15:07:01 -0700 (PDT) Received: from www.freebsd.org (www.freebsd.org [216.136.204.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 22F3743D39 for ; Fri, 21 May 2004 15:07:01 -0700 (PDT) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.12.11/8.12.11) with ESMTP id i4LM6uuk076907 for ; Fri, 21 May 2004 15:06:56 -0700 (PDT) (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.12.11/8.12.11/Submit) id i4LM6ut0076906; Fri, 21 May 2004 15:06:56 -0700 (PDT) (envelope-from nobody) Message-Id: <200405212206.i4LM6ut0076906@www.freebsd.org> Date: Fri, 21 May 2004 15:06:56 -0700 (PDT) From: Zhenmin To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-2.3 Subject: misc/67013: A potential bug detected in /sys/netipsec/key.c X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 May 2004 22:10:29 -0000 >Number: 67013 >Category: misc >Synopsis: A potential bug detected in /sys/netipsec/key.c >Confidential: no >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri May 21 15:10:23 PDT 2004 >Closed-Date: >Last-Modified: >Originator: Zhenmin >Release: 5.2.1 >Organization: OPERA Research Group, UIUC >Environment: >Description: The potential bug is detected by our analysis tool in file /sys/netipsec/key.c:3849 3849 if (spidx0->src.sin6.sin6_scope_id && 3850 spidx1->src.sin6.sin6_scope_id && 3851 spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id) 3852 return 0; 3853 if (!key_bbcmp(&spidx0->dst.sin6.sin6_addr, 3854 &spidx1->dst.sin6.sin6_addr, spidx0->prefd)) 3855 return 0; >How-To-Repeat: The potential bug is detected by our own analysis tool. >Fix: --- ./bsd-5.2.1/sys/netipsec/key.c 2003-09-29 17:57:43.000000000 -0500 +++ ./bsd-5.2.1/sys/netipsec/key.c.fixed 2004-05-21 17:01:05.000000000 -0500 @@ -3846,8 +3846,8 @@ * scope_id check. if sin6_scope_id is 0, we regard it * as a wildcard scope, which matches any scope zone ID. */ - if (spidx0->src.sin6.sin6_scope_id && - spidx1->src.sin6.sin6_scope_id && + if (spidx0->dst.sin6.sin6_scope_id && + spidx1->dst.sin6.sin6_scope_id && spidx0->dst.sin6.sin6_scope_id != spidx1->dst.sin6.sin6_scope_id) return 0; if (!key_bbcmp(&spidx0->dst.sin6.sin6_addr, >Release-Note: >Audit-Trail: >Unformatted: