d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Patch from Greg Ansley:

Browse Source 
In rare cases, when the filter specified accesses an multi-byte value that
is split across mbuf's, the value loaded is incorrect.  And if you are very
unlucky (like me) it will index off the end of the mbuf and into an
unallocated page and panic the system.

If you look at the code you will discover the the index *k* is added to
the pointer *cp* and the used AGAIN as a subscript.
This commit is contained in:
dg 1995-04-01 01:46:27 +00:00
parent e7f6953c5b
commit dfeb70b071
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/net/bpf_filter.c
View File

@ -37,7 +37,7 @@
*
* @(#)bpf_filter.c 8.1 (Berkeley) 6/10/93
*
* $Id$
* $Id: bpf_filter.c,v 1.3 1994/08/02 07:45:58 davidg Exp $
*/
#include <sys/param.h>
@ -112,14 +112,14 @@ m_xword(m, k, err)
switch (len - k) {
case 1:
return (cp[k] << 24) | (np[0] << 16) | (np[1] << 8) | np[2];
return (cp[0] << 24) | (np[0] << 16) | (np[1] << 8) | np[2];
case 2:
return (cp[k] << 24) | (cp[k + 1] << 16) | (np[0] << 8) |
return (cp[0] << 24) | (cp[1] << 16) | (np[0] << 8) |
np[1];
default:
return (cp[k] << 24) | (cp[k + 1] << 16) | (cp[k + 2] << 8) |
return (cp[0] << 24) | (cp[1] << 16) | (cp[2] << 8) |
np[0];
}
bad:
@ -153,7 +153,7 @@ m_xhalf(m, k, err)
if (m0 == 0)
goto bad;
*err = 0;
return (cp[k] << 8) | mtod(m0, u_char *)[0];
return (cp[0] << 8) | mtod(m0, u_char *)[0];
bad:
*err = 1;
return 0;