mirror/lwip
1
0
Fork 0
mirror of https://github.com/lwip-tcpip/lwip.git synced 2024-11-16 23:15:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

ethernet_input: fixed duplicate check for p->len

Browse Source 
See bug #54195.

Reported-by: Andrey Vinogradov <andrey.vinogradov@teplomonitor.ru>
Signed-off-by: Simon Goldschmidt <goldsimon@gmx.de>
This commit is contained in:
Simon Goldschmidt 2018-06-27 20:51:10 +02:00
parent f3e14585ad
commit 0c209dba4b
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/netif/ethernet.c
View File

@ -114,6 +114,7 @@ ethernet_input(struct pbuf *p, struct netif *netif)
#if ETHARP_SUPPORT_VLAN #if ETHARP_SUPPORT_VLAN
if (type == PP_HTONS(ETHTYPE_VLAN)) { if (type == PP_HTONS(ETHTYPE_VLAN)) {
struct eth_vlan_hdr *vlan = (struct eth_vlan_hdr *)(((char *)ethhdr) + SIZEOF_ETH_HDR); struct eth_vlan_hdr *vlan = (struct eth_vlan_hdr *)(((char *)ethhdr) + SIZEOF_ETH_HDR);
next_hdr_offset = SIZEOF_ETH_HDR + SIZEOF_VLAN_HDR;
if (p->len <= SIZEOF_ETH_HDR + SIZEOF_VLAN_HDR) { if (p->len <= SIZEOF_ETH_HDR + SIZEOF_VLAN_HDR) {
/* a packet with only an ethernet/vlan header (or less) is not valid for us */ /* a packet with only an ethernet/vlan header (or less) is not valid for us */
ETHARP_STATS_INC(etharp.proterr); ETHARP_STATS_INC(etharp.proterr);
@ -135,7 +136,6 @@ ethernet_input(struct pbuf *p, struct netif *netif)
} }
#endif /* defined(LWIP_HOOK_VLAN_CHECK) || defined(ETHARP_VLAN_CHECK) || defined(ETHARP_VLAN_CHECK_FN) */ #endif /* defined(LWIP_HOOK_VLAN_CHECK) || defined(ETHARP_VLAN_CHECK) || defined(ETHARP_VLAN_CHECK_FN) */
type = vlan->tpid; type = vlan->tpid;
next_hdr_offset = SIZEOF_ETH_HDR + SIZEOF_VLAN_HDR;
} }
#endif /* ETHARP_SUPPORT_VLAN */ #endif /* ETHARP_SUPPORT_VLAN */
@ -174,8 +174,8 @@ ethernet_input(struct pbuf *p, struct netif *netif)
if (!(netif->flags & NETIF_FLAG_ETHARP)) { if (!(netif->flags & NETIF_FLAG_ETHARP)) {
goto free_and_return; goto free_and_return;
} }
/* skip Ethernet header */ /* skip Ethernet header (min. size checked above) */
if ((p->len < next_hdr_offset) || pbuf_remove_header(p, next_hdr_offset)) { if (pbuf_remove_header(p, next_hdr_offset)) {
LWIP_DEBUGF(ETHARP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_LEVEL_WARNING, LWIP_DEBUGF(ETHARP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_LEVEL_WARNING,
("ethernet_input: IPv4 packet dropped, too short (%"U16_F"/%"U16_F")\n", ("ethernet_input: IPv4 packet dropped, too short (%"U16_F"/%"U16_F")\n",
p->tot_len, next_hdr_offset)); p->tot_len, next_hdr_offset));
@ -191,8 +191,8 @@ ethernet_input(struct pbuf *p, struct netif *netif)
if (!(netif->flags & NETIF_FLAG_ETHARP)) { if (!(netif->flags & NETIF_FLAG_ETHARP)) {
goto free_and_return; goto free_and_return;
} }
/* skip Ethernet header */ /* skip Ethernet header (min. size checked above) */
if ((p->len < next_hdr_offset) || pbuf_remove_header(p, next_hdr_offset)) { if (pbuf_remove_header(p, next_hdr_offset)) {
LWIP_DEBUGF(ETHARP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_LEVEL_WARNING, LWIP_DEBUGF(ETHARP_DEBUG | LWIP_DBG_TRACE | LWIP_DBG_LEVEL_WARNING,
("ethernet_input: ARP response packet dropped, too short (%"U16_F"/%"U16_F")\n", ("ethernet_input: ARP response packet dropped, too short (%"U16_F"/%"U16_F")\n",
p->tot_len, next_hdr_offset)); p->tot_len, next_hdr_offset));