Changeset 263

Timestamp:

04/14/11 21:04:16 (13 months ago)

Author:

marek

Message:

ap51-flash: replace unreliable strlen() check by ip header length

Signed-off-by: Marek Lindner <lindner_marek@…>

Files:

• ap51-flash-ng/proto.c (modified) (9 diffs)

ap51-flash-ng/proto.c

@@ -551 +551 @@
 {
         struct tcphdr *tcphdr;
+        unsigned int data_len;
         char *buff;
 
@@ -567 +568 @@
         if (tcphdr->ack != 1)
                 goto out;
+
+        data_len = packet_buff_len - (tcphdr->doff * 4);
 
         switch (node->tcp_state.status) {
@@ -585 +588 @@
                 buff = (char *)(tcphdr + 1);
                 node->tcp_state.status = TCP_STATUS_TELNET_READY;
-                node->tcp_state.my_ack_seq += packet_buff_len - (int)sizeof(struct tcphdr);
+                node->tcp_state.my_ack_seq += data_len;
 
                 /* send CTRL + C */
@@ -599 +602 @@
                 if ((tcphdr->seq == node->tcp_state.his_seq) &&
                     (tcphdr->ack_seq == node->tcp_state.his_ack_seq) &&
-                    (strlen((char *)(tcphdr + 1)) == node->tcp_state.his_last_len)) {
+                    (data_len == node->tcp_state.his_last_len)) {
                         /* printf("retransmission received: seq = %u, ack_seq: %u, len: %u\n",
-                               ntohl(tcphdr->seq), ntohl(tcphdr->ack_seq),
-                               (unsigned int)strlen((char *)(tcphdr + 1))); */
+                               ntohl(tcphdr->seq), ntohl(tcphdr->ack_seq), data_len); */
                         tcp_resend_data(node);
                         goto out;
@@ -609 +611 @@
                 node->tcp_state.his_seq = tcphdr->seq;
                 node->tcp_state.his_ack_seq = tcphdr->ack_seq;
-                node->tcp_state.his_last_len = strlen((char *)(tcphdr + 1));
+                node->tcp_state.his_last_len = data_len;
 
                 if (node->tcp_state.his_last_len == 0) {
@@ -617 +619 @@
                 }
 
-                node->tcp_state.my_ack_seq += packet_buff_len - (int)sizeof(struct tcphdr);
+                node->tcp_state.my_ack_seq += data_len;
                 if (ntohl(tcphdr->ack_seq) > node->tcp_state.my_seq)
                         node->tcp_state.my_seq = ntohl(tcphdr->ack_seq);
@@ -634 +636 @@
 {
         struct iphdr *iphdr;
+        int length;
 
         if (!len_check(packet_buff_len, sizeof(struct iphdr), "IPv4"))
@@ -671 +674 @@
                         break;
 
+                length = packet_buff_len;
+                if (length > ntohs(iphdr->tot_len))
+                        length = ntohs(iphdr->tot_len);
+
                 handle_tcp_packet(packet_buff + (iphdr->ihl * 4),
-                                  packet_buff_len - (iphdr->ihl * 4),
-                                  node);
+                                  length - (iphdr->ihl * 4), node);
                 break;
         }
@@ -709 +715 @@
                 if (!node)
                         return;
+
                 handle_ip_packet(packet_buff + ETH_HLEN,
                                  packet_buff_len - ETH_HLEN,