View | Details | Raw Unified | Return to bug 239975 | Differences between
and this patch

Collapse All | Expand All

(-)sbin/ping/ping.c (-2 / +2 lines)
Lines 1066-1072 Link Here
1066
	cc = ICMP_MINLEN + phdr_len + datalen;
1066
	cc = ICMP_MINLEN + phdr_len + datalen;
1067
1067
1068
	/* compute ICMP checksum here */
1068
	/* compute ICMP checksum here */
1069
	icp.icmp_cksum = in_cksum(outpack, cc);
1069
	icp.icmp_cksum = in_cksum(outpack, sizeof(struct icmp), IP_MAXPACKET, cc);
1070
	/* Update icmp_cksum in the raw packet data buffer. */
1070
	/* Update icmp_cksum in the raw packet data buffer. */
1071
	memcpy(outpack + offsetof(struct icmp, icmp_cksum), &icp.icmp_cksum,
1071
	memcpy(outpack + offsetof(struct icmp, icmp_cksum), &icp.icmp_cksum,
1072
	    sizeof(icp.icmp_cksum));
1072
	    sizeof(icp.icmp_cksum));
Lines 1079-1085 Link Here
1079
		/* Update ip_len in the raw packet data buffer. */
1079
		/* Update ip_len in the raw packet data buffer. */
1080
		memcpy(outpackhdr + offsetof(struct ip, ip_len), &ip.ip_len,
1080
		memcpy(outpackhdr + offsetof(struct ip, ip_len), &ip.ip_len,
1081
		    sizeof(ip.ip_len));
1081
		    sizeof(ip.ip_len));
1082
		ip.ip_sum = in_cksum(outpackhdr, cc);
1082
		ip.ip_sum = in_cksum(outpackhdr, sizeof(struct ip), IP_MAXPACKET, cc);
1083
		/* Update ip_sum in the raw packet data buffer. */
1083
		/* Update ip_sum in the raw packet data buffer. */
1084
		memcpy(outpackhdr + offsetof(struct ip, ip_sum), &ip.ip_sum,
1084
		memcpy(outpackhdr + offsetof(struct ip, ip_sum), &ip.ip_sum,
1085
		    sizeof(ip.ip_sum));
1085
		    sizeof(ip.ip_sum));
(-)sbin/ping/utils.c (-2 / +2 lines)
Lines 55-61 Link Here
55
 *	Checksum routine for Internet Protocol family headers (C Version)
55
 *	Checksum routine for Internet Protocol family headers (C Version)
56
 */
56
 */
57
u_short
57
u_short
58
in_cksum(u_char *addr, int len)
58
in_cksum(u_char *addr, size_t struct_size, int ip_maxpacket,  int len)
59
{
59
{
60
	int nleft, sum;
60
	int nleft, sum;
61
	u_char *w;
61
	u_char *w;
Lines 74-80 Link Here
74
	 * sequential 16 bit words to it, and at the end, fold back all the
74
	 * sequential 16 bit words to it, and at the end, fold back all the
75
	 * carry bits from the top 16 bits into the lower 16 bits.
75
	 * carry bits from the top 16 bits into the lower 16 bits.
76
	 */
76
	 */
77
	while (nleft > 1)  {
77
	while ((nleft > 1) && (w < &addr[ip_maxpacket - struct_size - sizeof(u_short)])) {
78
		u_short data;
78
		u_short data;
79
79
80
		memcpy(&data, w, sizeof(data));
80
		memcpy(&data, w, sizeof(data));
(-)sbin/ping/utils.h (-1 / +1 lines)
Lines 33-38 Link Here
33
33
34
#include <sys/types.h>
34
#include <sys/types.h>
35
35
36
u_short in_cksum(u_char *, int);
36
u_short in_cksum(u_char *, size_t, int, int);
37
37
38
#endif
38
#endif

Return to bug 239975