From 06339180179f0952000740f09ea83515d484b540 Mon Sep 17 00:00:00 2001 From: David Greenman Date: Wed, 23 Apr 1997 01:44:30 +0000 Subject: [PATCH] Check that the received packet length indicated by the card is at least large enough to contain the ethernet header. There appears to be a condition where the card can return "0" in some failure cases, and this causes bad things to happen (a panic). --- sys/dev/fxp/if_fxp.c | 6 +++++- sys/pci/if_fxp.c | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/sys/dev/fxp/if_fxp.c b/sys/dev/fxp/if_fxp.c index 5a041caa041..a6d23980a5e 100644 --- a/sys/dev/fxp/if_fxp.c +++ b/sys/dev/fxp/if_fxp.c @@ -24,7 +24,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $Id: if_fxp.c,v 1.32 1997/03/24 11:33:46 bde Exp $ + * $Id: if_fxp.c,v 1.33 1997/03/25 14:54:38 davidg Exp $ */ /* @@ -634,6 +634,10 @@ rcvloop: u_short total_len; total_len = rfa->actual_size & (MCLBYTES - 1); + if (total_len < sizeof(struct ether_header)) { + m_freem(m); + goto rcvloop; + } m->m_pkthdr.rcvif = ifp; m->m_pkthdr.len = m->m_len = total_len - sizeof(struct ether_header); diff --git a/sys/pci/if_fxp.c b/sys/pci/if_fxp.c index 5a041caa041..a6d23980a5e 100644 --- a/sys/pci/if_fxp.c +++ b/sys/pci/if_fxp.c @@ -24,7 +24,7 @@ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * $Id: if_fxp.c,v 1.32 1997/03/24 11:33:46 bde Exp $ + * $Id: if_fxp.c,v 1.33 1997/03/25 14:54:38 davidg Exp $ */ /* @@ -634,6 +634,10 @@ rcvloop: u_short total_len; total_len = rfa->actual_size & (MCLBYTES - 1); + if (total_len < sizeof(struct ether_header)) { + m_freem(m); + goto rcvloop; + } m->m_pkthdr.rcvif = ifp; m->m_pkthdr.len = m->m_len = total_len - sizeof(struct ether_header);