diff options
author | hm <hm@FreeBSD.org> | 2001-01-12 08:48:54 +0000 |
---|---|---|
committer | hm <hm@FreeBSD.org> | 2001-01-12 08:48:54 +0000 |
commit | 464b4ea94b020d774874ece666d82a1069507db5 (patch) | |
tree | 078014a935556b056b1efc8028a857b560679a60 /sys/i4b | |
parent | 0a7d951162b77fa339454fd992847b4802131a33 (diff) | |
download | FreeBSD-src-464b4ea94b020d774874ece666d82a1069507db5.zip FreeBSD-src-464b4ea94b020d774874ece666d82a1069507db5.tar.gz |
Fix a bug overwriting random data when Van Jacobsen header compression
was used with the isp/isppp driver.
Submitted by: Sergio de Souza Prallon <prallon@tmp.com.br>
Diffstat (limited to 'sys/i4b')
-rw-r--r-- | sys/i4b/driver/i4b_ispppsubr.c | 32 |
1 files changed, 21 insertions, 11 deletions
diff --git a/sys/i4b/driver/i4b_ispppsubr.c b/sys/i4b/driver/i4b_ispppsubr.c index 0fab45f..f7823ee 100644 --- a/sys/i4b/driver/i4b_ispppsubr.c +++ b/sys/i4b/driver/i4b_ispppsubr.c @@ -486,9 +486,10 @@ isppp_input(struct ifnet *ifp, struct mbuf *m) SPP_FMT "input packet is too small, %d bytes\n", SPP_ARGS(ifp), m->m_pkthdr.len); drop: + m_freem (m); + drop2: ++ifp->if_ierrors; ++ifp->if_iqdrops; - m_freem (m); return; } @@ -554,26 +555,35 @@ isppp_input(struct ifnet *ifp, struct mbuf *m) #ifdef SPPP_VJ case PPP_VJ_COMP: if (sp->state[IDX_IPCP] == STATE_OPENED) { - int len; + u_char *iphdr; + int hlen, vjlen; - if ((len = sl_uncompress_tcp( - (u_char **)&m->m_data, m->m_len, - TYPE_COMPRESSED_TCP, &sp->pp_comp)) <= 0) + if ((vjlen = sl_uncompress_tcp_core(m->m_data, + m->m_len, m->m_len, TYPE_COMPRESSED_TCP, + &sp->pp_comp, &iphdr, &hlen)) <= 0) goto drop; - m->m_len = m->m_pkthdr.len = len; + + m_adj(m, vjlen); + + M_PREPEND(m, hlen, M_DONTWAIT); + if (m == NULL) + goto drop2; + bcopy(iphdr, mtod(m, u_char *), hlen); + schednetisr (NETISR_IP); inq = &ipintrq; } break; case PPP_VJ_UCOMP: if (sp->state[IDX_IPCP] == STATE_OPENED) { - int len; + u_char *iphdr; + int hlen, vjlen; - if ((len = sl_uncompress_tcp( - (u_char **)&m->m_data, m->m_len, - TYPE_UNCOMPRESSED_TCP, &sp->pp_comp)) <= 0) + if ((vjlen = sl_uncompress_tcp_core(m->m_data, + m->m_len, m->m_len, TYPE_COMPRESSED_TCP, + &sp->pp_comp, &iphdr, &hlen)) <= 0) goto drop; - m->m_len = m->m_pkthdr.len = len; + schednetisr (NETISR_IP); inq = &ipintrq; } |