From f27a84317646769b581a8ee903a983af9306e6ec Mon Sep 17 00:00:00 2001 From: ae Date: Wed, 28 Oct 2015 17:55:37 +0000 Subject: [PATCH] Check the size of data available in mbuf, before using them. PR: 202667 MFC after: 1 week --- sys/net/if_gre.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c index ffd94d831b08..24ed971135c2 100644 --- a/sys/net/if_gre.c +++ b/sys/net/if_gre.c @@ -691,6 +691,14 @@ gre_input(struct mbuf **mp, int *offp, int proto) KASSERT(sc != NULL, ("encap_getarg returned NULL")); ifp = GRE2IFP(sc); + hlen = *offp + sizeof(struct grehdr) + 4 * sizeof(uint32_t); + if (m->m_pkthdr.len < hlen) + goto drop; + if (m->m_len < hlen) { + m = m_pullup(m, hlen); + if (m == NULL) + goto drop; + } gh = (struct grehdr *)mtodo(m, *offp); flags = ntohs(gh->gre_flags); if (flags & ~GRE_FLAGS_MASK) -- 2.39.5