From 997c6a4aecd34f2a5308d487eb77234a68f9781f Mon Sep 17 00:00:00 2001 From: florian Date: Sun, 20 Feb 2022 19:18:16 +0000 Subject: [PATCH] Nameservers in router advertisements are struct in6_addr, not struct sockaddr_in6. Copy the right amount of data so that we don't overflow the destination and potentially crash when we receive more than 7 nameservers. This is going to be 7.0 errata 014. OK deraadt --- sbin/slaacd/engine.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sbin/slaacd/engine.c b/sbin/slaacd/engine.c index 657b86803ed..3270db8e5ae 100644 --- a/sbin/slaacd/engine.c +++ b/sbin/slaacd/engine.c @@ -1,4 +1,4 @@ -/* $OpenBSD: engine.c,v 1.75 2022/01/03 16:42:17 florian Exp $ */ +/* $OpenBSD: engine.c,v 1.76 2022/02/20 19:18:16 florian Exp $ */ /* * Copyright (c) 2017 Florian Obser @@ -2237,7 +2237,7 @@ gen_rdns_proposal(struct slaacd_iface *iface, struct radv *ra) rdns_proposal->rdns_lifetime = ra->rdns_lifetime; LIST_FOREACH(rdns, &ra->rdns_servers, entries) { memcpy(&rdns_proposal->rdns[rdns_proposal->rdns_count++], - &rdns->rdns, sizeof(struct sockaddr_in6)); + &rdns->rdns, sizeof(struct in6_addr)); if (rdns_proposal->rdns_count == MAX_RDNS_COUNT) break; } -- 2.20.1