wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-23 11:44:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix TX overflow in rx_icmp()

Browse Source
This commit is contained in:
cpq committed 2022-09-29 11:13:40 +01:00
1 parent 7ff76f69a1
commit a88a11c243
2 files changed
+9 -7
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

mip/mip.c
+5 -4
View File
@@ -449,11 +449,12 @@ static void rx_icmp(struct mip_if *ifp, struct pkt *pkt) {
struct ip *ip = tx_ip(ifp, 1, ifp->ip, pkt->ip->src,
sizeof(struct icmp) + pkt->pay.len);
struct icmp *icmp = (struct icmp *) (ip + 1);
memset(icmp, 0, sizeof(*icmp)); // Important - set csum to 0
memcpy(icmp + 1, pkt->pay.buf, pkt->pay.len);
size_t len = PDIFF(ifp->tx.buf, icmp + 1), left = ifp->tx.len - len;
if (left > pkt->pay.len) left = pkt->pay.len; // Don't overflow TX
memset(icmp, 0, sizeof(*icmp)); // Set csum to 0
memcpy(icmp + 1, pkt->pay.buf, left); // Copy RX payload to TX
icmp->csum = ipcsum(icmp, sizeof(*icmp) + pkt->pay.len);
ifp->driver->tx(ifp->tx.buf, PDIFF(ifp->tx.buf, icmp + 1) + pkt->pay.len,
ifp->driver_data);
ifp->driver->tx(ifp->tx.buf, len + left, ifp->driver_data);
}
}
mongoose.c
+4 -3
View File
@@ -6714,11 +6714,12 @@ static void rx_icmp(struct mip_if *ifp, struct pkt *pkt) {
struct ip *ip = tx_ip(ifp, 1, ifp->ip, pkt->ip->src,
sizeof(struct icmp) + pkt->pay.len);
struct icmp *icmp = (struct icmp *) (ip + 1);
size_t len = PDIFF(ifp->tx.buf, icmp + 1), left = ifp->tx.len - len;
if (left > pkt->pay.len) left = pkt->pay.len;
memset(icmp, 0, sizeof(*icmp)); // Important - set csum to 0
memcpy(icmp + 1, pkt->pay.buf, pkt->pay.len);
memcpy(icmp + 1, pkt->pay.buf, left);
icmp->csum = ipcsum(icmp, sizeof(*icmp) + pkt->pay.len);
ifp->driver->tx(ifp->tx.buf, PDIFF(ifp->tx.buf, icmp + 1) + pkt->pay.len,
ifp->driver_data);
ifp->driver->tx(ifp->tx.buf, len + left, ifp->driver_data);
}
}