d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Check that the received packet length indicated by the card is at least

Browse Source 
large enough to contain the ethernet header. There appears to be a
condition where the card can return "0" in some failure cases, and this
causes bad things to happen (a panic).
This commit is contained in:
dg 1997-04-23 01:44:30 +00:00
parent 1be756644f
commit f096e34225
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
sys/dev/fxp/if_fxp.c
View File

@ -24,7 +24,7 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $Id: if_fxp.c,v 1.32 1997/03/24 11:33:46 bde Exp $
* $Id: if_fxp.c,v 1.33 1997/03/25 14:54:38 davidg Exp $
*/
/*
@ -634,6 +634,10 @@ rcvloop:
u_short total_len;
total_len = rfa->actual_size & (MCLBYTES - 1);
if (total_len < sizeof(struct ether_header)) {
m_freem(m);
goto rcvloop;
}
m->m_pkthdr.rcvif = ifp;
m->m_pkthdr.len = m->m_len = total_len -
sizeof(struct ether_header);

6
sys/pci/if_fxp.c
View File

@ -24,7 +24,7 @@
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $Id: if_fxp.c,v 1.32 1997/03/24 11:33:46 bde Exp $
* $Id: if_fxp.c,v 1.33 1997/03/25 14:54:38 davidg Exp $
*/
/*
@ -634,6 +634,10 @@ rcvloop:
u_short total_len;
total_len = rfa->actual_size & (MCLBYTES - 1);
if (total_len < sizeof(struct ether_header)) {
m_freem(m);
goto rcvloop;
}
m->m_pkthdr.rcvif = ifp;
m->m_pkthdr.len = m->m_len = total_len -
sizeof(struct ether_header);