diff options
| author | brian <brian@cvs.openbsd.org> | 1999-05-14 09:35:15 +0000 |
|---|---|---|
| committer | brian <brian@cvs.openbsd.org> | 1999-05-14 09:35:15 +0000 |
| commit | 64ebbf30bcc5a34d194bb6cf4297e3f4bcd7ee8b (patch) | |
| tree | 1b50a1aba6c6164ab7c5ddfcbdb771dd73ee30dd /usr.sbin | |
| parent | eb008e7bef31680581d6455083fd2dea7ccfa4e8 (diff) | |
Ensure that we're not going to overflow our ``struct tun''
when we mbuf_Read() into it.
Add the link name to a few diagnostics.
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/ppp/ppp/ip.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/usr.sbin/ppp/ppp/ip.c b/usr.sbin/ppp/ppp/ip.c index d680676a75a..727782ae847 100644 --- a/usr.sbin/ppp/ppp/ip.c +++ b/usr.sbin/ppp/ppp/ip.c @@ -17,7 +17,7 @@ * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE. * - * $Id: ip.c,v 1.9 1999/05/09 20:04:00 brian Exp $ + * $Id: ip.c,v 1.10 1999/05/14 09:35:14 brian Exp $ * * TODO: * o Return ICMP message for filterd packet @@ -395,6 +395,12 @@ ip_Input(struct bundle *bundle, struct link *l, struct mbuf *bp) tun_fill_header(tun, AF_INET); nb = mbuf_Length(bp); + if (nb > sizeof tun.data) { + log_Printf(LogWARN, "ip_Input: %s: Packet too large (got %d, max %d)\n", + l->name, nb, (int)(sizeof tun.data)); + mbuf_Free(bp); + return NULL; + } mbuf_Read(bp, tun.data, nb); if (PacketCheck(bundle, tun.data, nb, &bundle->filter.in) < 0) @@ -410,9 +416,10 @@ ip_Input(struct bundle *bundle, struct link *l, struct mbuf *bp) nw = write(bundle->dev.fd, &tun, nb); if (nw != nb) { if (nw == -1) - log_Printf(LogERROR, "ip_Input: wrote %d, got %s\n", nb, strerror(errno)); + log_Printf(LogERROR, "ip_Input: %s: wrote %d, got %s\n", + l->name, nb, strerror(errno)); else - log_Printf(LogERROR, "ip_Input: wrote %d, got %d\n", nb, nw); + log_Printf(LogERROR, "ip_Input: %s: wrote %d, got %d\n", l->name, nb, nw); } return NULL; |