diff options
| author | brian <brian@FreeBSD.org> | 1998-01-04 20:26:37 +0000 |
|---|---|---|
| committer | brian <brian@FreeBSD.org> | 1998-01-04 20:26:37 +0000 |
| commit | ddff13987cac56dbf156d50320561e6e60373af9 (patch) | |
| tree | 95118e0e0588b58030454e95e6375611c7a478f8 /usr.sbin/ppp/ip.c | |
| parent | 97d6e021bf076ca180eefdf6dbbb7d2c42b1a50c (diff) | |
| download | FreeBSD-src-ddff13987cac56dbf156d50320561e6e60373af9.zip FreeBSD-src-ddff13987cac56dbf156d50320561e6e60373af9.tar.gz | |
Don't scribble on the stack if our input packet is
bigger than our MRU. Moan and drop the packet
instead.
Diffstat (limited to 'usr.sbin/ppp/ip.c')
| -rw-r--r-- | usr.sbin/ppp/ip.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/usr.sbin/ppp/ip.c b/usr.sbin/ppp/ip.c index 6f9a30e..78ff87e 100644 --- a/usr.sbin/ppp/ip.c +++ b/usr.sbin/ppp/ip.c @@ -17,7 +17,7 @@ * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. * - * $Id: ip.c,v 1.34 1997/12/28 02:46:22 brian Exp $ + * $Id: ip.c,v 1.35 1997/12/29 22:23:11 brian Exp $ * * TODO: * o Return ICMP message for filterd packet @@ -396,6 +396,12 @@ IpInput(struct mbuf * bp) cp = tun.data; nb = 0; for (wp = bp; wp; wp = wp->next) { /* Copy to contiguous region */ + if (sizeof tun.data - (cp - tun.data) < wp->cnt) { + LogPrintf(LogERROR, "IpInput: Packet too large (%d) - dropped\n", + plength(bp)); + pfree(bp); + return; + } memcpy(cp, MBUF_CTOP(wp), wp->cnt); cp += wp->cnt; nb += wp->cnt; |
