mirror of
https://github.com/opnsense/src.git
synced 2026-05-14 18:20:21 -04:00
The header specifies the size of the option in multiples of eight bytes.
The option consists of an eight-byte header followed by one or more IPv6
addresses, so the option is invalid if the size is not equal to 1+2n for
some n>0. Check this.
The bug can cause random stack data to be formatted as an IPv6 address
and passed to resolvconf(8), but a host able to trigger the bug may also
specify arbitrary addresses this way.
Reported by: Q C <cq674350529@gmail.com>
Sponsored by: The FreeBSD Foundation
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| cap_llflags.c | ||
| cap_script.c | ||
| cap_sendmsg.c | ||
| dump.c | ||
| if.c | ||
| Makefile | ||
| Makefile.depend | ||
| Makefile.depend.options | ||
| rtsock.c | ||
| rtsol.c | ||
| rtsold.8 | ||
| rtsold.c | ||
| rtsold.h | ||