From: florian <florian@openbsd.org>
Date: Sun, 20 Feb 2022 19:18:16 +0000 (+0000)
Subject: Nameservers in router advertisements are struct in6_addr, not
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=997c6a4aecd34f2a5308d487eb77234a68f9781f;p=openbsd

Nameservers in router advertisements are struct in6_addr, not
struct sockaddr_in6. Copy the right amount of data so that we don't
overflow the destination and potentially crash when we receive more
than 7 nameservers.

This is going to be 7.0 errata 014.

OK deraadt
---

diff --git a/sbin/slaacd/engine.c b/sbin/slaacd/engine.c
index 657b86803ed..3270db8e5ae 100644
--- a/sbin/slaacd/engine.c
+++ b/sbin/slaacd/engine.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: engine.c,v 1.75 2022/01/03 16:42:17 florian Exp $	*/
+/*	$OpenBSD: engine.c,v 1.76 2022/02/20 19:18:16 florian Exp $	*/
 
 /*
  * Copyright (c) 2017 Florian Obser <florian@openbsd.org>
@@ -2237,7 +2237,7 @@ gen_rdns_proposal(struct slaacd_iface *iface, struct radv *ra)
 	rdns_proposal->rdns_lifetime = ra->rdns_lifetime;
 	LIST_FOREACH(rdns, &ra->rdns_servers, entries) {
 		memcpy(&rdns_proposal->rdns[rdns_proposal->rdns_count++],
-		    &rdns->rdns, sizeof(struct sockaddr_in6));
+		    &rdns->rdns, sizeof(struct in6_addr));
 		if (rdns_proposal->rdns_count == MAX_RDNS_COUNT)
 			break;
 	}