DragonFlyBSD Kernel Audit
DF-2611 / fix.diff
← back to finding ↓ download raw
--- a/sys/netinet6/icmp6.c
+++ b/sys/netinet6/icmp6.c
@@ -2503,9 +2503,15 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 		    (rt_router->rt_gateway->sa_family == AF_LINK) &&
 		    (sdl = (struct sockaddr_dl *)rt_router->rt_gateway) &&
 		    sdl->sdl_alen) {
+			int padlen;
+
 			nd_opt = (struct nd_opt_hdr *)p;
 			nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
 			nd_opt->nd_opt_len = len >> 3;
 			lladdr = (char *)(nd_opt + 1);
 			bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen);
+			/* the 8-byte-alignment pad is transmitted; zero it */
+			padlen = len - sizeof(*nd_opt) - ifp->if_addrlen;
+			if (padlen > 0)
+				bzero(lladdr + ifp->if_addrlen, padlen);
 			p += len;
 		}
 	}