chao
/
linuxptp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent message buffer corruption on receive. 

An oversize incoming packet might overwrite the reference counter in a
message. Prevent this by providing a buffer large enough for the largest
possible packet.

This will also be needed to support TLV suffixes.

Signed-off-by: Richard Cochran <richardcochran@gmail.com>
master
Richard Cochran 2012-07-08 13:11:38 +02:00
parent c1973c5e11
commit d7a67e9f89
2 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
msg.h
View File

@ -148,6 +148,10 @@ struct management_msg {
uint8_t suffix[0]; uint8_t suffix[0];
} PACKED; } PACKED;
struct message_data {
uint8_t buffer[1500];
} PACKED;
struct ptp_message { struct ptp_message {
union { union {
struct ptp_header header; struct ptp_header header;
@ -161,6 +165,7 @@ struct ptp_message {
struct pdelay_resp_fup_msg pdelay_resp_fup; struct pdelay_resp_fup_msg pdelay_resp_fup;
struct signaling_msg signaling; struct signaling_msg signaling;
struct management_msg management; struct management_msg management;
struct message_data data;
} PACKED; } PACKED;
/**/ /**/
int tail_room; int tail_room;

2
port.c
View File

@ -1283,7 +1283,7 @@ enum fsm_event port_event(struct port *p, int fd_index)
msg->hwts.type = p->timestamping; msg->hwts.type = p->timestamping;
cnt = transport_recv(p->trp, fd, msg, sizeof(*msg), &msg->hwts); cnt = transport_recv(p->trp, fd, msg, sizeof(msg->data), &msg->hwts);
if (cnt <= 0) { if (cnt <= 0) {
pr_err("port %hu: recv message failed", portnum(p)); pr_err("port %hu: recv message failed", portnum(p));
msg_put(msg); msg_put(msg);