[src/trunk]: src/sys/net Make sure we have an llc structure in the packet, an...

[maxv <maxv%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/c34471c33e47
branches:  trunk
changeset: 828350:c34471c33e47
user:      maxv <maxv%NetBSD.org@localhost>
date:      Sat Dec 09 10:19:42 2017 +0000

description:
Make sure we have an llc structure in the packet, and don't read past the
end of the mbuf if we don't. I'm wondering whether we should not pull up
instead, but whatever.

diffstat:

 sys/net/if_ethersubr.c |  9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diffs (38 lines):

diff -r a84de4de1b9c -r c34471c33e47 sys/net/if_ethersubr.c
--- a/sys/net/if_ethersubr.c    Sat Dec 09 10:14:04 2017 +0000
+++ b/sys/net/if_ethersubr.c    Sat Dec 09 10:19:42 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_ethersubr.c,v 1.248 2017/12/06 04:00:07 ozaki-r Exp $       */
+/*     $NetBSD: if_ethersubr.c,v 1.249 2017/12/09 10:19:42 maxv Exp $  */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -61,7 +61,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ethersubr.c,v 1.248 2017/12/06 04:00:07 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ethersubr.c,v 1.249 2017/12/09 10:19:42 maxv Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -833,6 +833,9 @@
                }
        } else {
 #if defined (LLC) || defined (NETATALK)
+               if (m->m_len < ehlen + sizeof(struct llc)) {
+                       goto dropanyway;
+               }
                l = (struct llc *)(eh+1);
                switch (l->llc_dsap) {
 #ifdef NETATALK
@@ -869,8 +872,8 @@
                                goto dropanyway;
                        }
                        break;
+#endif
                dropanyway:
-#endif
                default:
                        m_freem(m);
                        return;