]> git.ipfire.org Git - thirdparty/squid.git/commitdiff
pinger: Fix buffer overflow in Icmp6::Recv
authorYuriy M. Kaminskiy <yumkam@gmail.com>
Wed, 30 Mar 2016 14:47:53 +0000 (03:47 +1300)
committerAmos Jeffries <squid3@treenet.co.nz>
Wed, 30 Mar 2016 14:47:53 +0000 (03:47 +1300)
src/icmp/Icmp6.cc

index 13073b53d9611b62d8bb9e7e6b81339cb5855590..79aa8cfa8293ded7e38c58ab395ec588e9d4e85d 100644 (file)
@@ -278,7 +278,7 @@ Icmp6::Recv(void)
 
 
         ip = (struct ip6_hdr *) pkt;
-        pkt += sizeof(ip6_hdr);
+        NP: echo size needs to +sizeof(ip6_hdr);
 
     debugs(42,0, HERE << "ip6_nxt=" << ip->ip6_nxt <<
                ", ip6_plen=" << ip->ip6_plen <<
@@ -289,7 +289,6 @@ Icmp6::Recv(void)
     */
 
     icmp6header = (struct icmp6_hdr *) pkt;
-    pkt += sizeof(icmp6_hdr);
 
     if (icmp6header->icmp6_type != ICMP6_ECHO_REPLY) {
 
@@ -312,7 +311,7 @@ Icmp6::Recv(void)
         return;
     }
 
-    echo = (icmpEchoData *) pkt;
+    echo = (icmpEchoData *) (pkt + sizeof(icmp6_hdr));
 
     preply.opcode = echo->opcode;