tcp over udp: don't copy more bytes than avaiable

When copying the data in the first mbuf to get rid of the UDP
header, use the correct length. It was copying too much (8 bytes,
the length of the UDP header).
This only applies to handling TCP over UDP packets. The support for
TCP over UDP is disabled by default.

Reported by:		jtl
Reviewed by:		Peter Lei
MFC after:		3 days
Sponsored by:		Netflix, Inc.

This commit is contained in:

Michael Tuexen

2025-10-23 09:24:09 +02:00

parent c2b08c13c2

commit bfda98a420

1 changed files with 1 additions and 1 deletions

									
										sys/netinet/tcp_subr.c
									
		+1
		-1
	
												View File
												
				@@ -607,7 +607,7 @@ tcp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,

						}

					}

					m->m_pkthdr.tcp_tun_port = port = uh->uh_sport;

					bcopy(th, uh, m->m_len - off);

					bcopy(th, uh, m->m_len - off - sizeof(struct udphdr));

					m->m_len -= sizeof(struct udphdr);

					m->m_pkthdr.len -= sizeof(struct udphdr);

					/*