diff options
| author | luigi <luigi@FreeBSD.org> | 2001-02-08 22:21:30 +0000 |
|---|---|---|
| committer | luigi <luigi@FreeBSD.org> | 2001-02-08 22:21:30 +0000 |
| commit | d0c5714da1fdf4293227869eb8c006365705d394 (patch) | |
| tree | a4948b69c25d4a74600162fbfbc079575a831c13 /sys/dev/ed/if_ed.c | |
| parent | 1138c13e2858ebf247edf6e855eeb1bbedbe85a6 (diff) | |
| download | FreeBSD-src-d0c5714da1fdf4293227869eb8c006365705d394.zip FreeBSD-src-d0c5714da1fdf4293227869eb8c006365705d394.tar.gz | |
Make sure that we do not accept packets shorter than a full ethernet
header, or we would have a negative length passed to ether_input().
Diffstat (limited to 'sys/dev/ed/if_ed.c')
| -rw-r--r-- | sys/dev/ed/if_ed.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/dev/ed/if_ed.c b/sys/dev/ed/if_ed.c index 2c0967c..1d877cb 100644 --- a/sys/dev/ed/if_ed.c +++ b/sys/dev/ed/if_ed.c @@ -2174,8 +2174,10 @@ ed_rint(sc) * we have a length that will fit into one mbuf cluster or less; * the upper layer protocols can then figure out the length from * their own length field(s). + * But make sure that we have at least a full ethernet header + * or we would be unable to call ether_input() later. */ - if ((len > sizeof(struct ed_ring)) && + if ((len > sizeof(struct ed_ring) + ETHER_HDR_LEN) && (len <= MCLBYTES) && (packet_hdr.next_packet >= sc->rec_page_start) && (packet_hdr.next_packet < sc->rec_page_stop)) { |
