diff options
| author | Hellmuth Michaelis <hm@FreeBSD.org> | 2001-01-12 08:48:54 +0000 |
|---|---|---|
| committer | Hellmuth Michaelis <hm@FreeBSD.org> | 2001-01-12 08:48:54 +0000 |
| commit | 6c5ddf686373550380b83b335311f91188eebea0 (patch) | |
| tree | 92457795d5301c5158e7efba80e52b13688ba9fe /sys/i4b | |
| parent | 063415120be218fd786f7b2bb2f4bd42ac1de96f (diff) | |
| download | src-6c5ddf686373550380b83b335311f91188eebea0.tar.gz src-6c5ddf686373550380b83b335311f91188eebea0.zip | |
Fix a bug overwriting random data when Van Jacobsen header compression
was used with the isp/isppp driver.
Submitted by: Sergio de Souza Prallon <prallon@tmp.com.br>
Notes
Notes:
svn path=/head/; revision=70956
Diffstat (limited to 'sys/i4b')
| -rw-r--r-- | sys/i4b/driver/i4b_ispppsubr.c | 32 |
1 files changed, 21 insertions, 11 deletions
diff --git a/sys/i4b/driver/i4b_ispppsubr.c b/sys/i4b/driver/i4b_ispppsubr.c index 0fab45f82d8f..f7823ee9abc2 100644 --- a/sys/i4b/driver/i4b_ispppsubr.c +++ b/sys/i4b/driver/i4b_ispppsubr.c @@ -486,9 +486,10 @@ isppp_input(struct ifnet *ifp, struct mbuf *m) SPP_FMT "input packet is too small, %d bytes\n", SPP_ARGS(ifp), m->m_pkthdr.len); drop: + m_freem (m); + drop2: ++ifp->if_ierrors; ++ifp->if_iqdrops; - m_freem (m); return; } @@ -554,26 +555,35 @@ isppp_input(struct ifnet *ifp, struct mbuf *m) #ifdef SPPP_VJ case PPP_VJ_COMP: if (sp->state[IDX_IPCP] == STATE_OPENED) { - int len; + u_char *iphdr; + int hlen, vjlen; - if ((len = sl_uncompress_tcp( - (u_char **)&m->m_data, m->m_len, - TYPE_COMPRESSED_TCP, &sp->pp_comp)) <= 0) + if ((vjlen = sl_uncompress_tcp_core(m->m_data, + m->m_len, m->m_len, TYPE_COMPRESSED_TCP, + &sp->pp_comp, &iphdr, &hlen)) <= 0) goto drop; - m->m_len = m->m_pkthdr.len = len; + + m_adj(m, vjlen); + + M_PREPEND(m, hlen, M_DONTWAIT); + if (m == NULL) + goto drop2; + bcopy(iphdr, mtod(m, u_char *), hlen); + schednetisr (NETISR_IP); inq = &ipintrq; } break; case PPP_VJ_UCOMP: if (sp->state[IDX_IPCP] == STATE_OPENED) { - int len; + u_char *iphdr; + int hlen, vjlen; - if ((len = sl_uncompress_tcp( - (u_char **)&m->m_data, m->m_len, - TYPE_UNCOMPRESSED_TCP, &sp->pp_comp)) <= 0) + if ((vjlen = sl_uncompress_tcp_core(m->m_data, + m->m_len, m->m_len, TYPE_COMPRESSED_TCP, + &sp->pp_comp, &iphdr, &hlen)) <= 0) goto drop; - m->m_len = m->m_pkthdr.len = len; + schednetisr (NETISR_IP); inq = &ipintrq; } |