d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix possible buffer overrun on 64-bit arch when generating MAC

Browse Source 
address for tap interface.

Reported by:	Marc Lorner < marc dot loerner at hob dot de >
Reviewed by:	bms
MFC after:	3 days
This commit is contained in:
Maksim Yevmenkin 2008-04-15 16:54:39 +00:00
parent d61f3de656
commit bc225cd686
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/net/if_tap.c
View File

@ -404,6 +404,7 @@ tapcreate(struct cdev *dev)
struct ifnet *ifp = NULL;
struct tap_softc *tp = NULL;
unsigned short macaddr_hi;
uint32_t macaddr_mid;
int unit, s;
char *name = NULL;
u_char eaddr[6];
@ -432,8 +433,9 @@ tapcreate(struct cdev *dev)
/* generate fake MAC address: 00 bd xx xx xx unit_no */
macaddr_hi = htons(0x00bd);
macaddr_mid = (uint32_t) ticks;
bcopy(&macaddr_hi, eaddr, sizeof(short));
bcopy(&ticks, &eaddr[2], sizeof(long));
bcopy(&macaddr_mid, &eaddr[2], sizeof(uint32_t));
eaddr[5] = (u_char)unit;
/* fill the rest and attach interface */