diff options
| author | brian <brian@FreeBSD.org> | 1997-06-22 02:19:53 +0000 |
|---|---|---|
| committer | brian <brian@FreeBSD.org> | 1997-06-22 02:19:53 +0000 |
| commit | 9aa9d790d1364010763c386c6c004018a9fc1f68 (patch) | |
| tree | 1e41ff3a47ef89b64238010a06df248b0baa7d47 | |
| parent | 6ad9fbf52929d2c596a96030ce99062677d4c651 (diff) | |
| download | FreeBSD-src-9aa9d790d1364010763c386c6c004018a9fc1f68.zip FreeBSD-src-9aa9d790d1364010763c386c6c004018a9fc1f68.tar.gz | |
Fix this damn mbuf with a negative m_len. It turns
out to be a problem with VJ header compression.
davidg spotted this in usr.sbin/ppp/slcompress.c
a while ago, but I believe gave the wrong reasons -
it's too easy to reproduce ! The only scenario that
I've been able to reproduce the problem under is when
m_len is *exactly* 40 ! So go figure !
PR: 3749
Submitted elsewhere by: davidg
Obtained from: usr.sbin/ppp/slcompress.c
| -rw-r--r-- | sys/net/ppp_tty.c | 6 | ||||
| -rw-r--r-- | sys/net/slcompress.c | 6 |
2 files changed, 6 insertions, 6 deletions
diff --git a/sys/net/ppp_tty.c b/sys/net/ppp_tty.c index 7735edf..422a360 100644 --- a/sys/net/ppp_tty.c +++ b/sys/net/ppp_tty.c @@ -70,7 +70,7 @@ * Paul Mackerras (paulus@cs.anu.edu.au). */ -/* $Id: ppp_tty.c,v 1.19 1997/06/09 04:13:48 brian Exp $ */ +/* $Id: ppp_tty.c,v 1.20 1997/06/18 02:50:40 brian Exp $ */ /* from Id: ppp_tty.c,v 1.3 1995/08/16 01:36:40 paulus Exp */ /* from if_sl.c,v 1.11 84/10/04 12:54:47 rick Exp */ @@ -642,10 +642,6 @@ pppstart(tp) s = spltty(); /* in case.. do not want netisrs to preempt us */ - m = sc->sc_outm; - if (m && m->m_len < 0) - MFREE(m, sc->sc_outm); - idle = 0; while (CCOUNT(&tp->t_outq) < PPP_HIWAT) { /* diff --git a/sys/net/slcompress.c b/sys/net/slcompress.c index 839100c..cc7152a 100644 --- a/sys/net/slcompress.c +++ b/sys/net/slcompress.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)slcompress.c 8.2 (Berkeley) 4/16/94 - * $Id$ + * $Id: slcompress.c,v 1.9 1997/02/22 09:41:16 peter Exp $ */ /* @@ -217,6 +217,8 @@ sl_compress_tcp(m, ip, comp, compress_cid) comp->last_cs = lcs; hlen += th->th_off; hlen <<= 2; + if (hlen > m->m_len) + return TYPE_IP; goto uncompressed; found: @@ -247,6 +249,8 @@ sl_compress_tcp(m, ip, comp, compress_cid) deltaS = hlen; hlen += th->th_off; hlen <<= 2; + if (hlen > m->m_len) + return TYPE_IP; if (((u_short *)ip)[0] != ((u_short *)&cs->cs_ip)[0] || ((u_short *)ip)[3] != ((u_short *)&cs->cs_ip)[3] || |
