View | Details | Raw Unified | Return to bug 17872
Collapse All | Expand All

(-)if_ether.c (-16 / +9 lines)
Lines 434-440 Link Here
434
{
434
{
435
	register struct mbuf *m, *m0;
435
	register struct mbuf *m, *m0;
436
	register struct arphdr *ar;
436
	register struct arphdr *ar;
437
	int s, ml;
437
	int s;
438
438
439
	while (arpintrq.ifq_head) {
439
	while (arpintrq.ifq_head) {
440
		s = splimp();
440
		s = splimp();
Lines 442-448 Link Here
442
		splx(s);
442
		splx(s);
443
		if (m == 0 || (m->m_flags & M_PKTHDR) == 0)
443
		if (m == 0 || (m->m_flags & M_PKTHDR) == 0)
444
			panic("arpintr");
444
			panic("arpintr");
445
	
445
446
		if (m->mh_len < sizeof(struct arphdr) + 2 * ar->ar_hln
447
		    + 2 * ar->ar_pln) {
448
			log(LOG_ERR, "arp: runt packet\n");
449
			m_freem(m);
450
			continue;
451
		}
452
446
                if (m->m_len < sizeof(struct arphdr) &&
453
                if (m->m_len < sizeof(struct arphdr) &&
447
                    ((m = m_pullup(m, sizeof(struct arphdr))) == NULL)) {
454
                    ((m = m_pullup(m, sizeof(struct arphdr))) == NULL)) {
448
			log(LOG_ERR, "arp: runt packet -- m_pullup failed\n");
455
			log(LOG_ERR, "arp: runt packet -- m_pullup failed\n");
Lines 455-474 Link Here
455
			log(LOG_ERR,
462
			log(LOG_ERR,
456
			    "arp: unknown hardware address format (0x%2D)\n",
463
			    "arp: unknown hardware address format (0x%2D)\n",
457
			    (unsigned char *)&ar->ar_hrd, "");
464
			    (unsigned char *)&ar->ar_hrd, "");
458
			m_freem(m);
459
			continue;
460
		}
461
462
		m0 = m;
463
		ml = 0;
464
		while (m0 != NULL) {	
465
			ml += m0->m_len;	/* wanna implement m_size?? */
466
			m0 = m0->m_next;	
467
		}
468
469
		if (ml < sizeof(struct arphdr) + 2 * ar->ar_hln
470
		    + 2 * ar->ar_pln) {
471
			log(LOG_ERR, "arp: runt packet\n");
472
			m_freem(m);
465
			m_freem(m);
473
			continue;
466
			continue;
474
		}
467
		}

Return to bug 17872