Prevent message buffer corruption on receive.
An oversize incoming packet might overwrite the reference counter in a message. Prevent this by providing a buffer large enough for the largest possible packet. This will also be needed to support TLV suffixes. Signed-off-by: Richard Cochran <richardcochran@gmail.com>master
parent
c1973c5e11
commit
d7a67e9f89
5
msg.h
5
msg.h
|
@ -148,6 +148,10 @@ struct management_msg {
|
|||
uint8_t suffix[0];
|
||||
} PACKED;
|
||||
|
||||
struct message_data {
|
||||
uint8_t buffer[1500];
|
||||
} PACKED;
|
||||
|
||||
struct ptp_message {
|
||||
union {
|
||||
struct ptp_header header;
|
||||
|
@ -161,6 +165,7 @@ struct ptp_message {
|
|||
struct pdelay_resp_fup_msg pdelay_resp_fup;
|
||||
struct signaling_msg signaling;
|
||||
struct management_msg management;
|
||||
struct message_data data;
|
||||
} PACKED;
|
||||
/**/
|
||||
int tail_room;
|
||||
|
|
2
port.c
2
port.c
|
@ -1283,7 +1283,7 @@ enum fsm_event port_event(struct port *p, int fd_index)
|
|||
|
||||
msg->hwts.type = p->timestamping;
|
||||
|
||||
cnt = transport_recv(p->trp, fd, msg, sizeof(*msg), &msg->hwts);
|
||||
cnt = transport_recv(p->trp, fd, msg, sizeof(msg->data), &msg->hwts);
|
||||
if (cnt <= 0) {
|
||||
pr_err("port %hu: recv message failed", portnum(p));
|
||||
msg_put(msg);
|
||||
|
|
Loading…
Reference in New Issue