On Fri, 12 Oct 2001 17:46:20 CDT, latten@xxxxxxxxxxxxxx said: > >--- spd.h Tue Oct 9 11:39:11 2001 > >+++ spd.h.array Tue Oct 9 19:19:38 2001 > >@@ -72,7 +72,7 @@ > > rwlock_t lock; > > atomic_t count; > > struct selector selector; > >- struct list_head sa_index_list; > >+ struct sa_index *sa_index_list[3]; > > }; > > > >#define IPSEC_SP_AH 0 > >#define IPSEC_SP_ESP 1 > >#define IPSEC_SP_COMP 2 I haven't checked the source tree. Does it in fact do a bounds check to make sure that sa_index_list[i] isnt dereferenced unless i is in the range 0..2? Would make for a fast easy DOS attack otherwise... ;) -- Valdis Kletnieks Operating Systems Analyst Virginia Tech
Attachment:
pgpfM9TAiiRnL.pgp
Description: PGP signature