d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

- Fix NULL pointer dereference when a packet of uneven size is being

Browse Source 
transmitted.

Approved by:	re (kib)
MFC after:	3 days
This commit is contained in:
Stanislav Sedov 2011-09-02 20:35:22 +00:00
parent 871ffe942d
commit bd2369f62e
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/dev/smc/if_smc.c
View File

@ -538,6 +538,7 @@ smc_task_tx(void *context, int pending)
struct smc_softc *sc;
struct mbuf *m, *m0;
u_int packet, len;
int last_len;
uint8_t *data;
(void)pending;
@ -590,16 +591,18 @@ smc_task_tx(void *context, int pending)
* Push the data out to the device.
*/
data = NULL;
last_len = 0;
for (; m != NULL; m = m->m_next) {
data = mtod(m, uint8_t *);
smc_write_multi_2(sc, DATA0, (uint16_t *)data, m->m_len / 2);
last_len = m->m_len;
}
/*
* Push out the control byte and and the odd byte if needed.
*/
if ((len & 1) != 0 && data != NULL)
smc_write_2(sc, DATA0, (CTRL_ODD << 8) | data[m->m_len - 1]);
smc_write_2(sc, DATA0, (CTRL_ODD << 8) | data[last_len - 1]);
else
smc_write_2(sc, DATA0, 0);