The function ip6_get_prevhdr() did return a pointer into a mbuf.
authorbluhm <bluhm@openbsd.org>
Thu, 1 Feb 2018 21:11:33 +0000 (21:11 +0000)
committerbluhm <bluhm@openbsd.org>
Thu, 1 Feb 2018 21:11:33 +0000 (21:11 +0000)
commit8398ca50727d58ca8921f7441fcc20c08f9ade17
treed822a8390176a526533fb35c4ae40940838fd879
parentdf9b9db2c3d93a3b2fa67316cad3e2df6eeb53f5
The function ip6_get_prevhdr() did return a pointer into a mbuf.
It was not guaranteed that the mbuf data was not somewhere else in
the chain.  So return an offset and do a proper mbuf pulldown.
found by Maxime Villard; from NetBSD; with markus@; OK deraadt@
sys/netinet6/frag6.c
sys/netinet6/ip6_input.c
sys/netinet6/ip6_var.h
sys/netinet6/raw_ip6.c