diff options
| author | brian <brian@FreeBSD.org> | 1999-07-24 02:53:39 +0000 |
|---|---|---|
| committer | brian <brian@FreeBSD.org> | 1999-07-24 02:53:39 +0000 |
| commit | 85e61b75281aa38db19488901ea8948b3c8f5fa6 (patch) | |
| tree | 50350172c3970d9ad082f3981fc94776ebe8ecbc /usr.sbin/ppp | |
| parent | 02cdc154c9cfc7c75b2711b4e3e819d0745949b3 (diff) | |
| download | FreeBSD-src-85e61b75281aa38db19488901ea8948b3c8f5fa6.zip FreeBSD-src-85e61b75281aa38db19488901ea8948b3c8f5fa6.tar.gz | |
When we fetch previously retrieved IP fragments from the alias
tables, copy them correctly back into our mbuf rather giving a
bzero'd count to memcpy() and ending up with a 0 byte fragment.
The old code resulted in a 0 byte write to the tun device which
tickled a bug that resulted in a panic :-(
Diffstat (limited to 'usr.sbin/ppp')
| -rw-r--r-- | usr.sbin/ppp/alias_cmd.c | 9 | ||||
| -rw-r--r-- | usr.sbin/ppp/nat_cmd.c | 9 |
2 files changed, 10 insertions, 8 deletions
diff --git a/usr.sbin/ppp/alias_cmd.c b/usr.sbin/ppp/alias_cmd.c index 4fe2145..3c9acad 100644 --- a/usr.sbin/ppp/alias_cmd.c +++ b/usr.sbin/ppp/alias_cmd.c @@ -2,7 +2,7 @@ * The code in this file was written by Eivind Eklund <perhaps@yes.no>, * who places it in the public domain without restriction. * - * $Id: alias_cmd.c,v 1.26 1999/06/02 15:58:51 brian Exp $ + * $Id: alias_cmd.c,v 1.27 1999/06/10 00:17:26 brian Exp $ */ #include <sys/param.h> @@ -371,7 +371,7 @@ alias_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp, u_short *proto) { struct ip *pip, *piip; - int ret; + int ret, len; struct mbuf **last; char *fptr; @@ -412,8 +412,9 @@ alias_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp, last = &bp->pnext; while ((fptr = PacketAliasGetFragment(MBUF_CTOP(bp))) != NULL) { PacketAliasFragmentIn(MBUF_CTOP(bp), fptr); - *last = mbuf_Alloc(ntohs(((struct ip *)fptr)->ip_len), MB_ALIASIN); - memcpy(MBUF_CTOP(*last), fptr, (*last)->cnt); + len = ntohs(((struct ip *)fptr)->ip_len); + *last = mbuf_Alloc(len, MB_ALIASIN); + memcpy(MBUF_CTOP(*last), fptr, len); free(fptr); last = &(*last)->pnext; } diff --git a/usr.sbin/ppp/nat_cmd.c b/usr.sbin/ppp/nat_cmd.c index 4fe2145..3c9acad 100644 --- a/usr.sbin/ppp/nat_cmd.c +++ b/usr.sbin/ppp/nat_cmd.c @@ -2,7 +2,7 @@ * The code in this file was written by Eivind Eklund <perhaps@yes.no>, * who places it in the public domain without restriction. * - * $Id: alias_cmd.c,v 1.26 1999/06/02 15:58:51 brian Exp $ + * $Id: alias_cmd.c,v 1.27 1999/06/10 00:17:26 brian Exp $ */ #include <sys/param.h> @@ -371,7 +371,7 @@ alias_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp, u_short *proto) { struct ip *pip, *piip; - int ret; + int ret, len; struct mbuf **last; char *fptr; @@ -412,8 +412,9 @@ alias_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp, last = &bp->pnext; while ((fptr = PacketAliasGetFragment(MBUF_CTOP(bp))) != NULL) { PacketAliasFragmentIn(MBUF_CTOP(bp), fptr); - *last = mbuf_Alloc(ntohs(((struct ip *)fptr)->ip_len), MB_ALIASIN); - memcpy(MBUF_CTOP(*last), fptr, (*last)->cnt); + len = ntohs(((struct ip *)fptr)->ip_len); + *last = mbuf_Alloc(len, MB_ALIASIN); + memcpy(MBUF_CTOP(*last), fptr, len); free(fptr); last = &(*last)->pnext; } |
