File bug-424311_mipv6-daemon-0.5rc1.diff of Package mipv6d
Should apply to git.linux-ipv6.org/gitroot/mipv6-daemon.git c4a8e574785794dcc9022f8f39f087999c5f8f41
diff -ruN mipv6-daemon.orig/src/ha.c mipv6-daemon/src/ha.c
--- mipv6-daemon.orig/src/ha.c 2010-07-06 14:50:34.000000000 +0200
+++ mipv6-daemon/src/ha.c 2010-07-06 14:53:00.000000000 +0200
@@ -104,6 +104,8 @@
if (opt[0] == ND_OPT_PREFIX_INFORMATION) {
struct nd_opt_prefix_info *p;
+ if (olen < sizeof(struct nd_opt_prefix_info))
+ return;
p = (struct nd_opt_prefix_info *)opt;
if (p->nd_opt_pi_prefix_len > 128)
return;
@@ -117,6 +119,8 @@
} else if (opt[0] == ND_OPT_HOME_AGENT_INFO &&
ra->nd_ra_flags_reserved & ND_RA_FLAG_HOME_AGENT) {
struct nd_opt_homeagent_info *hainfo;
+ if (olen < sizeof(struct nd_opt_homeagent_info))
+ return;
hainfo = (struct nd_opt_homeagent_info *)opt;
pref = ntohs(hainfo->nd_opt_hai_preference);
life = ntohs(hainfo->nd_opt_hai_lifetime);
diff -ruN mipv6-daemon.orig/src/mn.c mipv6-daemon/src/mn.c
--- mipv6-daemon.orig/src/mn.c 2010-07-06 14:50:34.000000000 +0200
+++ mipv6-daemon/src/mn.c 2010-07-06 14:54:12.000000000 +0200
@@ -1646,9 +1646,10 @@
iif = pkt_info.ipi6_ifindex;
na = (struct nd_neighbor_advert *)msg;
- if (iif != ifindex ||
- hoplimit < 255 || na->nd_na_code != 0 ||
- len < sizeof(struct nd_neighbor_advert) ||
+ if (iif != ifindex ||
+ hoplimit < 255 ||
+ len < sizeof(struct nd_neighbor_advert) ||
+ na->nd_na_code != 0 ||
IN6_IS_ADDR_MULTICAST(&na->nd_na_target) ||
(na->nd_na_flags_reserved & ND_NA_FLAG_SOLICITED &&
IN6_IS_ADDR_MULTICAST(daddr)))
diff -ruN mipv6-daemon.orig/src/movement.c mipv6-daemon/src/movement.c
--- mipv6-daemon.orig/src/movement.c 2010-07-06 14:50:34.000000000 +0200
+++ mipv6-daemon/src/movement.c 2010-07-06 14:56:44.000000000 +0200
@@ -818,6 +818,11 @@
struct nlmsghdr *n, void *arg)
{
pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
+
+ /* only accept messages from kernel */
+ if (who->nl_pid)
+ goto out;
+
switch (n->nlmsg_type) {
case RTM_NEWLINK:
case RTM_DELLINK:
@@ -837,6 +842,8 @@
/* To do: listen to changes in default and prefix routes(?) */
break;
}
+
+out:
pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, NULL);
return 0;
}
diff -ruN mipv6-daemon.orig/src/xfrm.c mipv6-daemon/src/xfrm.c
--- mipv6-daemon.orig/src/xfrm.c 2010-07-06 14:50:34.000000000 +0200
+++ mipv6-daemon/src/xfrm.c 2010-07-06 14:57:38.000000000 +0200
@@ -1939,6 +1939,11 @@
static int xfrm_rcv(const struct sockaddr_nl *who, struct nlmsghdr *n, void *arg)
{
pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
+
+ /* only accept messages from kernel */
+ if (who->nl_pid)
+ goto out;
+
switch (n->nlmsg_type) {
case XFRM_MSG_ACQUIRE:
/* Start RO or send BRR */
@@ -1949,6 +1954,9 @@
parse_report(n);
break;
}
+
+
+out:
pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, NULL);
return 0;
}