Changeset 15573 in vbox for trunk/src/VBox/Devices/Network/slirp/socket.c

Timestamp:

Dec 16, 2008 11:24:50 AM (16 years ago)

Author:

vboxsync

Message:

NAT: sanity check

File:

• trunk/src/VBox/Devices/Network/slirp/socket.c (modified) (6 diffs)

trunk/src/VBox/Devices/Network/slirp/socket.c

@@ -795 +795 @@
     struct icmp *icp;
     int old_ip_len;
-    int hlen, original_hlen;
+    int hlen, original_hlen = 0;
     struct mbuf *m;
     struct icmp_msg *icm;
@@ -805 +805 @@
 
     LogRel(("ICMP:received msg(t:%d, c:%d)\n", icp->icmp_type, icp->icmp_code));
-    if (icp->icmp_type != ICMP_ECHOREPLY 
-        && icp->icmp_type != ICMP_TIMXCEED 
+    if (   icp->icmp_type != ICMP_ECHOREPLY
+        && icp->icmp_type != ICMP_TIMXCEED
         && icp->icmp_type != ICMP_UNREACH)
     {
@@ -812 +812 @@
     }
 
-    if (icp->icmp_type == ICMP_TIMXCEED 
-        || icp->icmp_type == ICMP_UNREACH )
+    if (   icp->icmp_type == ICMP_TIMXCEED
+        || icp->icmp_type == ICMP_UNREACH)
         ip = &icp->icmp_ip;
 
@@ -832 +832 @@
     proto = ip->ip_p;
     /* Now ip is pointing on header we've sent from guest */
-    if (icp->icmp_type == ICMP_TIMXCEED 
-        ||  icp->icmp_type == ICMP_UNREACH)
+    if (   icp->icmp_type == ICMP_TIMXCEED
+        || icp->icmp_type == ICMP_UNREACH)
     {
         old_ip_len = (ip->ip_hl << 2) + 64;
+        if (old_ip_len > sizeof(ip_copy))
+            old_ip_len = sizeof(ip_copy);
         memcpy(ip_copy, ip, old_ip_len);
     }
@@ -852 +854 @@
 
     icp = (struct icmp *)((char *)ip + (ip->ip_hl << 2));
-    if (icp->icmp_type == ICMP_TIMXCEED
+    if (   icp->icmp_type == ICMP_TIMXCEED
         || icp->icmp_type == ICMP_UNREACH)
     {
@@ -866 +868 @@
     /* Don't call m_free here*/
 
-    if (icp->icmp_type == ICMP_TIMXCEED
+    if (   icp->icmp_type == ICMP_TIMXCEED
         || icp->icmp_type == ICMP_UNREACH)
     {