diff options
| author | wpaul <wpaul@FreeBSD.org> | 1999-12-23 19:05:58 +0000 |
|---|---|---|
| committer | wpaul <wpaul@FreeBSD.org> | 1999-12-23 19:05:58 +0000 |
| commit | c517a960f8f491354ad4b6430f1e48e8973690ae (patch) | |
| tree | eeb6199dcab891d54bf36e886b53655afdd6a2f4 | |
| parent | 3bc63b4b30beb304ed622f0dae79f2b4b3ef2293 (diff) | |
| download | FreeBSD-src-c517a960f8f491354ad4b6430f1e48e8973690ae.zip FreeBSD-src-c517a960f8f491354ad4b6430f1e48e8973690ae.tar.gz | |
Fix problem reported by Matt Dillon. Occasionally, very small received
frames would be handled incorrectly due to bad usage of m_pullup() in
the case where the frame wraps from the end of the receive buffer back
the beginning.
Also, when manually extending small packets to pad them to the minimum
frame length during transmission, zero out the pad area to make some
really paranoid people happy.
| -rw-r--r-- | sys/pci/if_rl.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/sys/pci/if_rl.c b/sys/pci/if_rl.c index 64532c2..bd735c6 100644 --- a/sys/pci/if_rl.c +++ b/sys/pci/if_rl.c @@ -1130,7 +1130,12 @@ static void rl_rxeof(sc) m_adj(m, RL_ETHER_ALIGN); m_copyback(m, wrap, total_len - wrap, sc->rl_cdata.rl_rx_buf); - m = m_pullup(m, MHLEN - RL_ETHER_ALIGN); + m = m_pullup(m, sizeof(struct ether_header)); + if (m == NULL) { + printf("rl%d: m_pullup failed", + sc->rl_unit); + ifp->if_ierrors++; + } } cur_rx = (total_len - wrap + ETHER_CRC_LEN); } else { @@ -1345,6 +1350,14 @@ static int rl_encap(sc, m_head) /* Pad frames to at least 60 bytes. */ if (m_head->m_pkthdr.len < RL_MIN_FRAMELEN) { + /* + * Make security concious people happy: zero out the + * bytes in the pad area, since we don't know what + * this mbuf cluster buffer's previous user might + * have left in it. + */ + bzero(mtod(m_head, char *) + m_head->m_pkthdr.len, + RL_MIN_FRAMELEN - m_head->m_pkthdr.len); m_head->m_pkthdr.len += (RL_MIN_FRAMELEN - m_head->m_pkthdr.len); m_head->m_len = m_head->m_pkthdr.len; |
