diff options
| author | emax <emax@FreeBSD.org> | 2008-04-15 16:54:39 +0000 |
|---|---|---|
| committer | emax <emax@FreeBSD.org> | 2008-04-15 16:54:39 +0000 |
| commit | 0a1ecdd2e84b6fef841d34c4bf72c2db962b0c24 (patch) | |
| tree | 56543c3d20bf5f362a43275c50512ab4f4df9d1f /sys/net/if_tap.c | |
| parent | a19eeb1bb90be407b05f596feb555c76224c1e2b (diff) | |
| download | FreeBSD-src-0a1ecdd2e84b6fef841d34c4bf72c2db962b0c24.zip FreeBSD-src-0a1ecdd2e84b6fef841d34c4bf72c2db962b0c24.tar.gz | |
Fix possible buffer overrun on 64-bit arch when generating MAC
address for tap interface.
Reported by: Marc Lorner < marc dot loerner at hob dot de >
Reviewed by: bms
MFC after: 3 days
Diffstat (limited to 'sys/net/if_tap.c')
| -rw-r--r-- | sys/net/if_tap.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/net/if_tap.c b/sys/net/if_tap.c index e08b3b6..b8136d1 100644 --- a/sys/net/if_tap.c +++ b/sys/net/if_tap.c @@ -404,6 +404,7 @@ tapcreate(struct cdev *dev) struct ifnet *ifp = NULL; struct tap_softc *tp = NULL; unsigned short macaddr_hi; + uint32_t macaddr_mid; int unit, s; char *name = NULL; u_char eaddr[6]; @@ -432,8 +433,9 @@ tapcreate(struct cdev *dev) /* generate fake MAC address: 00 bd xx xx xx unit_no */ macaddr_hi = htons(0x00bd); + macaddr_mid = (uint32_t) ticks; bcopy(&macaddr_hi, eaddr, sizeof(short)); - bcopy(&ticks, &eaddr[2], sizeof(long)); + bcopy(&macaddr_mid, &eaddr[2], sizeof(uint32_t)); eaddr[5] = (u_char)unit; /* fill the rest and attach interface */ |
