diff options
author | patacongo <patacongo@42af7a65-404d-4744-a932-0658087f49c3> | 2012-02-18 22:09:09 +0000 |
---|---|---|
committer | patacongo <patacongo@42af7a65-404d-4744-a932-0658087f49c3> | 2012-02-18 22:09:09 +0000 |
commit | 92526b8dc0925c81edc33b794dd3d546de04b096 (patch) | |
tree | 0d70276a12875c48450c56fea8a84b9820a289f5 /nuttx/net/uip/uip_input.c | |
parent | fadbb925a6a118790d8d661fea3956bb0f76348a (diff) | |
download | nuttx-92526b8dc0925c81edc33b794dd3d546de04b096.tar.gz nuttx-92526b8dc0925c81edc33b794dd3d546de04b096.tar.bz2 nuttx-92526b8dc0925c81edc33b794dd3d546de04b096.zip |
Correct a buffer size error in the STM32 ethernet driver
git-svn-id: svn://svn.code.sf.net/p/nuttx/code/trunk@4403 42af7a65-404d-4744-a932-0658087f49c3
Diffstat (limited to 'nuttx/net/uip/uip_input.c')
-rw-r--r-- | nuttx/net/uip/uip_input.c | 31 |
1 files changed, 17 insertions, 14 deletions
diff --git a/nuttx/net/uip/uip_input.c b/nuttx/net/uip/uip_input.c index 05fc358be..99e237929 100644 --- a/nuttx/net/uip/uip_input.c +++ b/nuttx/net/uip/uip_input.c @@ -2,8 +2,8 @@ * net/uip/uip_input.c * The uIP TCP/IP stack code. * - * Copyright (C) 2007-2009 Gregory Nutt. All rights reserved. - * Author: Gregory Nutt <spudmonkey@racsa.co.cr> + * Copyright (C) 2007-2009, 2012 Gregory Nutt. All rights reserved. + * Author: Gregory Nutt <gnutt@nuttx.org> * * Adapted for NuttX from logic in uIP which also has a BSD-like license: * @@ -297,6 +297,7 @@ nullreturn: void uip_input(struct uip_driver_s *dev) { struct uip_ip_hdr *pbuf = BUF; + uint16_t iplen; /* This is where the input processing starts. */ @@ -343,20 +344,23 @@ void uip_input(struct uip_driver_s *dev) * we set d_len to the correct value. */ - if ((pbuf->len[0] << 8) + pbuf->len[1] <= dev->d_len) - { - dev->d_len = (pbuf->len[0] << 8) + pbuf->len[1]; #ifdef CONFIG_NET_IPv6 - /* The length reported in the IPv6 header is the length of the - * payload that follows the header. However, uIP uses the d_len - * variable for holding the size of the entire packet, including the - * IP header. For IPv4 this is not a problem as the length field in - * the IPv4 header contains the length of the entire packet. But - * for IPv6 we need to add the size of the IPv6 header (40 bytes). - */ + /* The length reported in the IPv6 header is the length of the payload + * that follows the header. However, uIP uses the d_len variable for + * holding the size of the entire packet, including the IP header. For + * IPv4 this is not a problem as the length field in the IPv4 header + * contains the length of the entire packet. But for IPv6 we need to add + * the size of the IPv6 header (40 bytes). + */ - dev->d_len += 40; + iplen = (pbuf->len[0] << 8) + pbuf->len[1] + UIP_IPH_LEN; +#else + iplen = (pbuf->len[0] << 8) + pbuf->len[1]; #endif /* CONFIG_NET_IPv6 */ + + if (iplen <= dev->d_len) + { + dev->d_len = iplen; } else { @@ -538,4 +542,3 @@ drop: dev->d_len = 0; } #endif /* CONFIG_NET */ - |