diff options
| author | phk <phk@FreeBSD.org> | 1996-03-04 15:58:25 +0000 |
|---|---|---|
| committer | phk <phk@FreeBSD.org> | 1996-03-04 15:58:25 +0000 |
| commit | 8383c5910ea9725e1af95c6a43e2c9b9a00b0fb1 (patch) | |
| tree | 51174454209cc170837f9e49556b9f13ee5eda38 | |
| parent | bfc69caaf8ba078b5f894036735634372072935e (diff) | |
| download | FreeBSD-src-8383c5910ea9725e1af95c6a43e2c9b9a00b0fb1.zip FreeBSD-src-8383c5910ea9725e1af95c6a43e2c9b9a00b0fb1.tar.gz | |
Validate the length before we trust it.
Submitted by: Andrew.Gordon@net-tel.co.uk
| -rw-r--r-- | sys/i386/isa/lpt.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/i386/isa/lpt.c b/sys/i386/isa/lpt.c index 7b37dfa..ab9744c 100644 --- a/sys/i386/isa/lpt.c +++ b/sys/i386/isa/lpt.c @@ -46,7 +46,7 @@ * SUCH DAMAGE. * * from: unknown origin, 386BSD 0.1 - * $Id: lpt.c,v 1.48 1995/12/10 13:38:56 phk Exp $ + * $Id: lpt.c,v 1.49 1996/02/06 18:50:52 wollman Exp $ */ /* @@ -1077,6 +1077,8 @@ lpintr (int unit) if (j == -1) goto err; len = len + (j << 8); + if (len > sc->sc_if.if_mtu + MLPIPHDRLEN) + goto err; bp = sc->sc_ifbuf; |
