the patch inline, since it's so small:
diff -r 2eb370412ac3 appl/lib/ip.b
--- a/appl/lib/ip.b Wed Jul 01 00:00:22 2009 +0100
+++ b/appl/lib/ip.b Fri Jul 17 17:58:29 2009 +0200
@@ -66,7 +66,7 @@
IPaddr.newv6(a: array of byte): IPaddr
{
- b := array[len a] of byte;
+ b := array[IPaddrlen] of byte;
b[0:] = a[0:IPaddrlen];
return IPaddr(b);
}
the thing is: Udphdr.unpack() calls IPaddr.newv6() with arrays longer than
IPaddrlen. IPaddr.newv6() creates b with the same longer length. then
when IPaddr.v6() is called, a copy of the array for IPaddrlen bytes is
created, but the entire array is copied in:
IPaddr.v6(ip: self IPaddr): array of byte
{
a := array[IPaddrlen] of byte;
a[0:] = ip.a;
return a;
}
causing an out of bounds exception.
this happens when you unpack an udp header, and repack it again for a
response message.
Original issue reported on code.google.com by mechiel@ueber.net on 17 Jul 2009 at 4:12
Original issue reported on code.google.com by
mechiel@ueber.net
on 17 Jul 2009 at 4:12