[src/trunk]: src/sys/net Make sure we have an llc structure in the packet, an...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2057e4e9d7f5
branches:  trunk
changeset: 358049:2057e4e9d7f5
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sat Dec 09 10:19:42 2017 +0000

description:
Make sure we have an llc structure in the packet, and don't read past the
end of the mbuf if we don't. I'm wondering whether we should not pull up
instead, but whatever.

diffstat:

 sys/net/if_ethersubr.c |  9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diffs (38 lines):

diff -r 4c4372cf2904 -r 2057e4e9d7f5 sys/net/if_ethersubr.c
--- a/sys/net/if_ethersubr.c    Sat Dec 09 10:14:04 2017 +0000
+++ b/sys/net/if_ethersubr.c    Sat Dec 09 10:19:42 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_ethersubr.c,v 1.248 2017/12/06 04:00:07 ozaki-r Exp $       */
+/*     $NetBSD: if_ethersubr.c,v 1.249 2017/12/09 10:19:42 maxv Exp $  */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ethersubr.c,v 1.248 2017/12/06 04:00:07 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ethersubr.c,v 1.249 2017/12/09 10:19:42 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -833,6 +833,9 @@
                }
        } else {
 #if defined (LLC) || defined (NETATALK)
+               if (m->m_len < ehlen + sizeof(struct llc)) {
+                       goto dropanyway;
+               }
                l = (struct llc *)(eh+1);
                switch (l->llc_dsap) {
 #ifdef NETATALK
@@ -869,8 +872,8 @@
                                goto dropanyway;
                        }
                        break;
+#endif
                dropanyway:
-#endif
                default:
                        m_freem(m);
                        return;