FreeBSD Bugzilla – Attachment 109203 Details for
Bug 150176
[libpcap] [patch] pcap(3): pcap_read_bpf() p->cc can go negative
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
file.diff
file.diff (text/plain), 1.32 KB, created by
guy
on 2010-09-01 09:00:10 UTC
(
hide
)
Description:
file.diff
Filename:
MIME Type:
Creator:
guy
Created:
2010-09-01 09:00:10 UTC
Size:
1.32 KB
patch
obsolete
>diff --git a/pcap-bpf.c b/pcap-bpf.c >index 666acf9..bcbfbef 100644 >--- a/pcap-bpf.c >+++ b/pcap-bpf.c >@@ -955,14 +955,28 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user) > * processed so far. > */ > if (p->break_loop) { >+ p->bp = bp; >+ p->cc = ep - bp; >+ /* >+ * ep is set based on the return value of read(), >+ * but read() from a BPF device doesn't necessarily >+ * return a value that's a multiple of the alignment >+ * value for BPF_WORDALIGN(). However, whenever we >+ * increment bp, we round up the increment value by >+ * a value rounded up by BPF_WORDALIGN(), so we >+ * could increment bp past ep after processing the >+ * last packet in the buffer. >+ * >+ * We treat ep < bp as an indication that this >+ * happened, and just set p->cc to 0. >+ */ >+ if (p->cc < 0) >+ p->cc = 0; > if (n == 0) { > p->break_loop = 0; > return (PCAP_ERROR_BREAK); >- } else { >- p->bp = bp; >- p->cc = ep - bp; >+ } else > return (n); >- } > } > > caplen = bhp->bh_caplen; >@@ -1014,6 +1028,11 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user) > if (++n >= cnt && cnt > 0) { > p->bp = bp; > p->cc = ep - bp; >+ /* >+ * See comment above about p->cc < 0. >+ */ >+ if (p->cc < 0) >+ p->cc = 0; > return (n); > } > } else {
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
Attachments on
bug 150176
: 109203