Page MenuHomeFreeBSD

ping: Fix an unsigned integer overflow (D38470 alternate take)
AbandonedPublic

Authored by jlduran on Feb 14 2023, 6:41 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Apr 20, 2:29 PM
Unknown Object (File)
Sun, Apr 20, 12:48 PM
Unknown Object (File)
Sun, Apr 20, 12:18 AM
Unknown Object (File)
Sat, Apr 19, 11:14 PM
Unknown Object (File)
Fri, Mar 28, 3:08 AM
Unknown Object (File)
Tue, Mar 25, 12:12 PM
Unknown Object (File)
Mar 8 2025, 5:37 PM
Unknown Object (File)
Feb 21 2025, 9:14 PM

Details

Reviewers
markj
Summary

The function pr_pack() prints out a packet, if the IP packet contains options, these are printed as well.
Commit 46d7b45a267b3d78c5054b210ff7b6c55bfca42b introduced an integer overflow bug, by changing hlen from int to uint8_t.
Revert this part of the code to the way it was before by creating an int type variable optslen, to be decremented instead of hlen.

Fixes: 46d7b45a267b3d78c5054b210ff7b6c55bfca42b

Test Plan

DISCLAIMER: My preferred route would be to implement D38431, however for reasons detailed in that review, we'll resort to fixing what we currently have.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped