From 086c5738bcd3c203bcc08d024fcf983cb409115f Mon Sep 17 00:00:00 2001 From: deraadt Date: Sun, 12 Apr 2026 23:57:27 +0000 Subject: [PATCH] These programs spin if they receive a RA from the local network with ND option with length 0. from Daniel Wade ok florian this will be errata 7.7/036_v6daemons.patch and 7.8/030_v6daemons.patch --- sbin/slaacd/engine.c | 6 +++++- usr.sbin/rad/engine.c | 4 +++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/sbin/slaacd/engine.c b/sbin/slaacd/engine.c index 8f1bd038533..1ab6fb38f33 100644 --- a/sbin/slaacd/engine.c +++ b/sbin/slaacd/engine.c @@ -1,4 +1,4 @@ -/* $OpenBSD: engine.c,v 1.99 2024/11/21 13:35:20 claudio Exp $ */ +/* $OpenBSD: engine.c,v 1.100 2026/04/12 23:57:31 deraadt Exp $ */ /* * Copyright (c) 2017 Florian Obser @@ -1474,6 +1474,8 @@ parse_ra(struct slaacd_iface *iface, struct imsg_ra *ra) struct in6_addr *in6; int i; + if (nd_opt_hdr->nd_opt_len == 0) + goto err; len -= sizeof(struct nd_opt_hdr); p += sizeof(struct nd_opt_hdr); @@ -1760,6 +1762,8 @@ debug_log_ra(struct imsg_ra *ra) struct in6_addr *in6; int i; + if (nd_opt_hdr->nd_opt_len == 0) + return; len -= sizeof(struct nd_opt_hdr); p += sizeof(struct nd_opt_hdr); if (nd_opt_hdr->nd_opt_len * 8 - 2 > len) { diff --git a/usr.sbin/rad/engine.c b/usr.sbin/rad/engine.c index 98fdd105cfc..f46d5c83bbb 100644 --- a/usr.sbin/rad/engine.c +++ b/usr.sbin/rad/engine.c @@ -1,4 +1,4 @@ -/* $OpenBSD: engine.c,v 1.29 2025/04/27 16:23:04 florian Exp $ */ +/* $OpenBSD: engine.c,v 1.30 2026/04/12 23:57:27 deraadt Exp $ */ /* * Copyright (c) 2018 Florian Obser @@ -541,6 +541,8 @@ parse_rs(struct imsg_ra_rs *rs) while ((size_t)len >= sizeof(struct nd_opt_hdr)) { struct nd_opt_hdr *nd_opt_hdr = (struct nd_opt_hdr *)p; + if (nd_opt_hdr->nd_opt_len == 0) + return; len -= sizeof(struct nd_opt_hdr); p += sizeof(struct nd_opt_hdr);