From 85e61b75281aa38db19488901ea8948b3c8f5fa6 Mon Sep 17 00:00:00 2001
From: brian <brian@FreeBSD.org>
Date: Sat, 24 Jul 1999 02:53:39 +0000
Subject: When we fetch previously retrieved IP fragments from the alias
 tables, copy them correctly back into our mbuf rather giving a bzero'd count
 to memcpy() and ending up with a 0 byte fragment.

The old code resulted in a 0 byte write to the tun device which
tickled a bug that resulted in a panic :-(
---
 usr.sbin/ppp/alias_cmd.c | 9 +++++----
 usr.sbin/ppp/nat_cmd.c   | 9 +++++----
 2 files changed, 10 insertions(+), 8 deletions(-)

(limited to 'usr.sbin/ppp')

diff --git a/usr.sbin/ppp/alias_cmd.c b/usr.sbin/ppp/alias_cmd.c
index 4fe2145..3c9acad 100644
--- a/usr.sbin/ppp/alias_cmd.c
+++ b/usr.sbin/ppp/alias_cmd.c
@@ -2,7 +2,7 @@
  * The code in this file was written by Eivind Eklund <perhaps@yes.no>,
  * who places it in the public domain without restriction.
  *
- *	$Id: alias_cmd.c,v 1.26 1999/06/02 15:58:51 brian Exp $
+ *	$Id: alias_cmd.c,v 1.27 1999/06/10 00:17:26 brian Exp $
  */
 
 #include <sys/param.h>
@@ -371,7 +371,7 @@ alias_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp,
                 u_short *proto)
 {
   struct ip *pip, *piip;
-  int ret;
+  int ret, len;
   struct mbuf **last;
   char *fptr;
 
@@ -412,8 +412,9 @@ alias_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp,
       last = &bp->pnext;
       while ((fptr = PacketAliasGetFragment(MBUF_CTOP(bp))) != NULL) {
 	PacketAliasFragmentIn(MBUF_CTOP(bp), fptr);
-        *last = mbuf_Alloc(ntohs(((struct ip *)fptr)->ip_len), MB_ALIASIN);
-        memcpy(MBUF_CTOP(*last), fptr, (*last)->cnt);
+        len = ntohs(((struct ip *)fptr)->ip_len);
+        *last = mbuf_Alloc(len, MB_ALIASIN);
+        memcpy(MBUF_CTOP(*last), fptr, len);
         free(fptr);
         last = &(*last)->pnext;
       }
diff --git a/usr.sbin/ppp/nat_cmd.c b/usr.sbin/ppp/nat_cmd.c
index 4fe2145..3c9acad 100644
--- a/usr.sbin/ppp/nat_cmd.c
+++ b/usr.sbin/ppp/nat_cmd.c
@@ -2,7 +2,7 @@
  * The code in this file was written by Eivind Eklund <perhaps@yes.no>,
  * who places it in the public domain without restriction.
  *
- *	$Id: alias_cmd.c,v 1.26 1999/06/02 15:58:51 brian Exp $
+ *	$Id: alias_cmd.c,v 1.27 1999/06/10 00:17:26 brian Exp $
  */
 
 #include <sys/param.h>
@@ -371,7 +371,7 @@ alias_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp,
                 u_short *proto)
 {
   struct ip *pip, *piip;
-  int ret;
+  int ret, len;
   struct mbuf **last;
   char *fptr;
 
@@ -412,8 +412,9 @@ alias_LayerPull(struct bundle *bundle, struct link *l, struct mbuf *bp,
       last = &bp->pnext;
       while ((fptr = PacketAliasGetFragment(MBUF_CTOP(bp))) != NULL) {
 	PacketAliasFragmentIn(MBUF_CTOP(bp), fptr);
-        *last = mbuf_Alloc(ntohs(((struct ip *)fptr)->ip_len), MB_ALIASIN);
-        memcpy(MBUF_CTOP(*last), fptr, (*last)->cnt);
+        len = ntohs(((struct ip *)fptr)->ip_len);
+        *last = mbuf_Alloc(len, MB_ALIASIN);
+        memcpy(MBUF_CTOP(*last), fptr, len);
         free(fptr);
         last = &(*last)->pnext;
       }
-- 
cgit v1.1