Correct a buffer size error in the STM32 ethernet driver

git-svn-id: svn://svn.code.sf.net/p/nuttx/code/trunk@4403 42af7a65-404d-4744-a932-0658087f49c3

3 files changed, 21 insertions, 18 deletions

diff --git a/nuttx/net/net_timeo.c b/nuttx/net/net_timeo.c
index 42d1aff0a..c593c45c7 100644
--- a/nuttx/net/net_timeo.c
+++ b/nuttx/net/net_timeo.c
@@ -1,8 +1,8 @@
 /****************************************************************************
  * net/net_timeo.c
  *
- *   Copyright (C) 2007-2009, 2011 Gregory Nutt. All rights reserved.
- *   Author: Gregory Nutt <spudmonkey@racsa.co.cr>
+ *   Copyright (C) 2007-2009, 2011-2012 Gregory Nutt. All rights reserved.
+ *   Author: Gregory Nutt <gnutt@nuttx.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/nuttx/net/uip/uip_chksum.c b/nuttx/net/uip/uip_chksum.c
index 4bddf3fbc..65b9e5889 100644
--- a/nuttx/net/uip/uip_chksum.c
+++ b/nuttx/net/uip/uip_chksum.c
@@ -1,8 +1,8 @@
 /****************************************************************************
  * net/uip/uip_chksum.c
  *
- *   Copyright (C) 2007-2010 Gregory Nutt. All rights reserved.
- *   Author: Gregory Nutt <spudmonkey@racsa.co.cr>
+ *   Copyright (C) 2007-2010, 2012 Gregory Nutt. All rights reserved.
+ *   Author: Gregory Nutt <gnutt@nuttx.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/nuttx/net/uip/uip_input.c b/nuttx/net/uip/uip_input.c
index 05fc358be..99e237929 100644
--- a/nuttx/net/uip/uip_input.c
+++ b/nuttx/net/uip/uip_input.c
@@ -2,8 +2,8 @@
  * net/uip/uip_input.c
  * The uIP TCP/IP stack code.
  *
- *   Copyright (C) 2007-2009 Gregory Nutt. All rights reserved.
- *   Author: Gregory Nutt <spudmonkey@racsa.co.cr>
+ *   Copyright (C) 2007-2009, 2012 Gregory Nutt. All rights reserved.
+ *   Author: Gregory Nutt <gnutt@nuttx.org>
  *
  * Adapted for NuttX from logic in uIP which also has a BSD-like license:
  *
@@ -297,6 +297,7 @@ nullreturn:
 void uip_input(struct uip_driver_s *dev)
 {
   struct uip_ip_hdr *pbuf = BUF;
+  uint16_t iplen;
 
   /* This is where the input processing starts. */
 
@@ -343,20 +344,23 @@ void uip_input(struct uip_driver_s *dev)
    * we set d_len to the correct value.
    */
 
-  if ((pbuf->len[0] << 8) + pbuf->len[1] <= dev->d_len)
-    {
-      dev->d_len = (pbuf->len[0] << 8) + pbuf->len[1];
 #ifdef CONFIG_NET_IPv6
-      /* The length reported in the IPv6 header is the length of the
-       * payload that follows the header. However, uIP uses the d_len
-       * variable for holding the size of the entire packet, including the
-       * IP header. For IPv4 this is not a problem as the length field in
-       * the IPv4 header contains the length of the entire packet. But
-       * for IPv6 we need to add the size of the IPv6 header (40 bytes).
-       */
+  /* The length reported in the IPv6 header is the length of the payload
+   * that follows the header. However, uIP uses the d_len variable for
+   * holding the size of the entire packet, including the IP header. For
+   * IPv4 this is not a problem as the length field in the IPv4 header
+   * contains the length of the entire packet. But for IPv6 we need to add
+   * the size of the IPv6 header (40 bytes).
+   */
 
-      dev->d_len += 40;
+  iplen = (pbuf->len[0] << 8) + pbuf->len[1] + UIP_IPH_LEN;
+#else
+  iplen = (pbuf->len[0] << 8) + pbuf->len[1];
 #endif /* CONFIG_NET_IPv6 */
+
+  if (iplen <= dev->d_len)
+    {
+      dev->d_len = iplen;
     }
   else
     {
@@ -538,4 +542,3 @@ drop:
   dev->d_len = 0;
 }
 #endif /* CONFIG_NET */
-