radvd/radvd-1.5-overflow.patch
Jan Görig 2a3066558a - updated to latest upstream version
- fixed #554125 - added error message
2010-01-13 14:22:11 +00:00

101 lines
2.9 KiB
Diff

diff -up radvd-1.5/send.c.patch radvd-1.5/send.c
--- radvd-1.5/send.c.patch 2009-09-07 09:59:57.000000000 +0200
+++ radvd-1.5/send.c 2010-01-13 14:54:18.634775543 +0100
@@ -66,6 +66,17 @@ send_ra_forall(int sock, struct Interfac
return 0;
}
+static void
+send_ra_inc_len(size_t *len, int add)
+{
+ *len += add;
+ if(*len >= MSG_SIZE)
+ {
+ flog(LOG_ERR, "Too many prefixes or routes. Exiting.");
+ exit(1);
+ }
+}
+
int
send_ra(int sock, struct Interface *iface, struct in6_addr *dest)
{
@@ -80,9 +91,7 @@ send_ra(int sock, struct Interface *ifac
struct AdvPrefix *prefix;
struct AdvRoute *route;
struct AdvRDNSS *rdnss;
- /* XXX: we don't keep track if buff gets overflowed. In theory the sysadmin could
- do that with e.g., too many advertised prefixes or routes, but buff is just so
- large that this should never happen and if it does, it's admin's fault :-) */
+
unsigned char buff[MSG_SIZE];
size_t len = 0;
ssize_t err;
@@ -193,7 +202,7 @@ send_ra(int sock, struct Interface *ifac
memcpy(&pinfo->nd_opt_pi_prefix, &prefix->Prefix,
sizeof(struct in6_addr));
- len += sizeof(*pinfo);
+ send_ra_inc_len(&len, sizeof(*pinfo));
}
prefix = prefix->next;
@@ -222,7 +231,7 @@ send_ra(int sock, struct Interface *ifac
memcpy(&rinfo->nd_opt_ri_prefix, &route->Prefix,
sizeof(struct in6_addr));
- len += sizeof(*rinfo);
+ send_ra_inc_len(&len, sizeof(*rinfo));
route = route->next;
}
@@ -254,7 +263,7 @@ send_ra(int sock, struct Interface *ifac
sizeof(struct in6_addr));
memcpy(&rdnssinfo->nd_opt_rdnssi_addr3, &rdnss->AdvRDNSSAddr3,
sizeof(struct in6_addr));
- len += sizeof(*rdnssinfo) - (3-rdnss->AdvRDNSSNumber)*sizeof(struct in6_addr);
+ send_ra_inc_len(&len, sizeof(*rdnssinfo) - (3-rdnss->AdvRDNSSNumber)*sizeof(struct in6_addr));
rdnss = rdnss->next;
}
@@ -273,7 +282,7 @@ send_ra(int sock, struct Interface *ifac
mtu->nd_opt_mtu_reserved = 0;
mtu->nd_opt_mtu_mtu = htonl(iface->AdvLinkMTU);
- len += sizeof(*mtu);
+ send_ra_inc_len(&len, sizeof(*mtu));
}
/*
@@ -290,11 +299,11 @@ send_ra(int sock, struct Interface *ifac
*ucp++ = ND_OPT_SOURCE_LINKADDR;
*ucp++ = (uint8_t) ((iface->if_hwaddr_len + 16 + 63) >> 6);
- len += 2 * sizeof(uint8_t);
+ send_ra_inc_len(&len, 2 * sizeof(uint8_t));
i = (iface->if_hwaddr_len + 7) >> 3;
memcpy(buff + len, iface->if_hwaddr, i);
- len += i;
+ send_ra_inc_len(&len, i);
}
/*
@@ -320,7 +329,7 @@ send_ra(int sock, struct Interface *ifac
a_ival.adv_ival = htonl(ival);
memcpy(buff + len, &a_ival, sizeof(a_ival));
- len += sizeof(a_ival);
+ send_ra_inc_len(&len, sizeof(a_ival));
}
/*
@@ -342,7 +351,7 @@ send_ra(int sock, struct Interface *ifac
ha_info.lifetime = htons(iface->HomeAgentLifetime);
memcpy(buff + len, &ha_info, sizeof(ha_info));
- len += sizeof(ha_info);
+ send_ra_inc_len(&len, sizeof(ha_info));
}
iov.iov_len = len;