diff options
| author | Kevin Lo <kevlo@cvs.openbsd.org> | 2017-07-21 00:55:06 +0000 |
|---|---|---|
| committer | Kevin Lo <kevlo@cvs.openbsd.org> | 2017-07-21 00:55:06 +0000 |
| commit | 7c0da4f96e489e1be816f59e353cae08a73481a0 (patch) | |
| tree | ec13fff1e128812f7f1a92eb44685254cf00d149 /sys | |
| parent | df010582cf2c5fda9fdc0299df2a6f842cd85af5 (diff) | |
Drop Rx'd frames larger than MCLBYTES.
Problem reported by Ilja Van Sprundel.
ok stsp@, tb@
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/dev/usb/if_run.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/sys/dev/usb/if_run.c b/sys/dev/usb/if_run.c index f8769b938d0..cc44eb44439 100644 --- a/sys/dev/usb/if_run.c +++ b/sys/dev/usb/if_run.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_run.c,v 1.120 2017/07/03 09:21:09 kevlo Exp $ */ +/* $OpenBSD: if_run.c,v 1.121 2017/07/21 00:55:05 kevlo Exp $ */ /*- * Copyright (c) 2008-2010 Damien Bergamini <damien.bergamini@free.fr> @@ -2184,6 +2184,11 @@ run_rx_frame(struct run_softc *sc, uint8_t *buf, int dmalen) DPRINTF(("bad RXWI length %u > %u\n", len, dmalen)); return; } + if (len > MCLBYTES) { + DPRINTF(("frame too large (length=%d)\n", len)); + ifp->if_ierrors++; + return; + } /* Rx descriptor is located at the end */ rxd = (struct rt2870_rxd *)(buf + dmalen); flags = letoh32(rxd->flags); |