diff options
| author | dg <dg@FreeBSD.org> | 1997-04-23 01:44:30 +0000 |
|---|---|---|
| committer | dg <dg@FreeBSD.org> | 1997-04-23 01:44:30 +0000 |
| commit | f096e342252b8fe9464ee2c8e6d01de2544e211d (patch) | |
| tree | 1bf9c85c5deed89460cef7cc5e9e3fd5e4b05a86 /sys/dev/fxp | |
| parent | 1be756644f233cf92f54886fd260615c13927ed1 (diff) | |
| download | FreeBSD-src-f096e342252b8fe9464ee2c8e6d01de2544e211d.zip FreeBSD-src-f096e342252b8fe9464ee2c8e6d01de2544e211d.tar.gz | |
Check that the received packet length indicated by the card is at least
large enough to contain the ethernet header. There appears to be a
condition where the card can return "0" in some failure cases, and this
causes bad things to happen (a panic).
Diffstat (limited to 'sys/dev/fxp')
| -rw-r--r-- | sys/dev/fxp/if_fxp.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys/dev/fxp/if_fxp.c b/sys/dev/fxp/if_fxp.c index 5a041ca..a6d2398 100644 --- a/sys/dev/fxp/if_fxp.c +++ b/sys/dev/fxp/if_fxp.c @@ -24,7 +24,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $Id: if_fxp.c,v 1.32 1997/03/24 11:33:46 bde Exp $ + * $Id: if_fxp.c,v 1.33 1997/03/25 14:54:38 davidg Exp $ */ /* @@ -634,6 +634,10 @@ rcvloop: u_short total_len; total_len = rfa->actual_size & (MCLBYTES - 1); + if (total_len < sizeof(struct ether_header)) { + m_freem(m); + goto rcvloop; + } m->m_pkthdr.rcvif = ifp; m->m_pkthdr.len = m->m_len = total_len - sizeof(struct ether_header); |
