diff options
| author | brian <brian@FreeBSD.org> | 1997-06-22 02:19:53 +0000 |
|---|---|---|
| committer | brian <brian@FreeBSD.org> | 1997-06-22 02:19:53 +0000 |
| commit | 9aa9d790d1364010763c386c6c004018a9fc1f68 (patch) | |
| tree | 1e41ff3a47ef89b64238010a06df248b0baa7d47 /sys/net/slcompress.c | |
| parent | 6ad9fbf52929d2c596a96030ce99062677d4c651 (diff) | |
| download | FreeBSD-src-9aa9d790d1364010763c386c6c004018a9fc1f68.zip FreeBSD-src-9aa9d790d1364010763c386c6c004018a9fc1f68.tar.gz | |
Fix this damn mbuf with a negative m_len. It turns
out to be a problem with VJ header compression.
davidg spotted this in usr.sbin/ppp/slcompress.c
a while ago, but I believe gave the wrong reasons -
it's too easy to reproduce ! The only scenario that
I've been able to reproduce the problem under is when
m_len is *exactly* 40 ! So go figure !
PR: 3749
Submitted elsewhere by: davidg
Obtained from: usr.sbin/ppp/slcompress.c
Diffstat (limited to 'sys/net/slcompress.c')
| -rw-r--r-- | sys/net/slcompress.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys/net/slcompress.c b/sys/net/slcompress.c index 839100c..cc7152a 100644 --- a/sys/net/slcompress.c +++ b/sys/net/slcompress.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)slcompress.c 8.2 (Berkeley) 4/16/94 - * $Id$ + * $Id: slcompress.c,v 1.9 1997/02/22 09:41:16 peter Exp $ */ /* @@ -217,6 +217,8 @@ sl_compress_tcp(m, ip, comp, compress_cid) comp->last_cs = lcs; hlen += th->th_off; hlen <<= 2; + if (hlen > m->m_len) + return TYPE_IP; goto uncompressed; found: @@ -247,6 +249,8 @@ sl_compress_tcp(m, ip, comp, compress_cid) deltaS = hlen; hlen += th->th_off; hlen <<= 2; + if (hlen > m->m_len) + return TYPE_IP; if (((u_short *)ip)[0] != ((u_short *)&cs->cs_ip)[0] || ((u_short *)ip)[3] != ((u_short *)&cs->cs_ip)[3] || |
