o Pass our negotiated number of VJ slots into

  sl_uncompress_tcp() and drop packets with
  slot numbers that are out of range.
o Drop packets that want to use a slot that still
  has an IP header length of 0 (ie, the requested
  slot number is bogus again).

Without this code, if the other side mis-behaves (and
sends us garbage slot numbers), we happily ``adjust''
a memset(..., '\0', ...) TCP/IP header and promptly
cr*p all over the stack before returning.... quickly
followed by a SIGBUS.

Dodgy ISP used by, and help locating the problem from: jmz
Problem also seen by: Mourad de Riche <omnibus@image.dk>

There's still a link lockup after this happens, but my
bets are on the other side (who has already started sending
rubbish) being to blame.

0 files changed, 0 insertions, 0 deletions