File ncpfs-hg-commit-427.patch of Package ncpfs

changeset:   427:225fa587c2d8
user:        Petr Vandrovec <petr@vandrovec.name>
date:        Sun Jun 05 14:35:13 2005 +0000
files:       ipx-1.0/Samples/rip.c ipx-1.0/Samples/sap.c
description:
Fix problems in ipx samples when packet with zero or 1 byte received.


diff -r 08cd551d8c1c -r 225fa587c2d8 ipx-1.0/Samples/rip.c
--- a/ipx-1.0/Samples/rip.c	Sun Jun 05 14:23:57 2005 +0000
+++ b/ipx-1.0/Samples/rip.c	Sun Jun 05 14:35:13 2005 +0000
@@ -36,6 +36,8 @@ main(int argc, char **argv)
 	}
 	while (1)
 	{
+		size_t rclen;
+
 		len = sizeof(sipx);
 		result = recvfrom(s, msg, sizeof(msg), 0,
 				  (struct sockaddr *) &sipx, &len);
@@ -44,8 +46,12 @@ main(int argc, char **argv)
 			perror("IPX: recvfrom");
 			exit(-1);
 		}
+		if (result < 2) {
+			fprintf(stderr, "Received packet is too short to be RIP packet (%d bytes)\n", result);
+			continue;
+		}
+		rclen = result - 2;
 		bptr = msg;
-		result -= 2;
 		printf("RIP packet from: %08X:%02X%02X%02X%02X%02X%02X\n",
 		       (u_int32_t)htonl(sipx.sipx_network),
 		       sipx.sipx_node[0], sipx.sipx_node[1],
@@ -53,11 +59,11 @@ main(int argc, char **argv)
 		       sipx.sipx_node[6], sipx.sipx_node[5]);
 		bptr += 2;
 		rp = (struct rip_data *) bptr;
-		while (result >= sizeof(struct rip_data))
+		while (rclen >= sizeof(struct rip_data))
 		{
 			printf("\tNET: %08X HOPS: %d\n", (u_int32_t)ntohl(rp->rip_net),
 			       ntohs(rp->rip_hops));
-			result -= sizeof(struct rip_data);
+			rclen -= sizeof(struct rip_data);
 			rp++;
 		}
 	}
diff -r 08cd551d8c1c -r 225fa587c2d8 ipx-1.0/Samples/sap.c
--- a/ipx-1.0/Samples/sap.c	Sun Jun 05 14:23:57 2005 +0000
+++ b/ipx-1.0/Samples/sap.c	Sun Jun 05 14:35:13 2005 +0000
@@ -47,6 +47,8 @@ main(int argc, char **argv)
 	}
 	while (1)
 	{
+		size_t rclen;
+
 		len = 1024;
 		result = recvfrom(s, msg, sizeof(msg), 0,
 				  (struct sockaddr *) &sipx, &len);
@@ -55,16 +57,20 @@ main(int argc, char **argv)
 			perror("IPX: recvfrom: ");
 			exit(-1);
 		}
+		if (result < 2) {
+			fprintf(stderr, "Received packet is too short to be SAP packet (%d bytes)\n", result);
+			continue;
+		}
+		rclen = result - 2;
 		bptr = msg;
-		result -= 2;
 		printf("SAP: OP is %x %x\n", bptr[0], bptr[1]);
-		printf("Length is %d\n", result);
+		printf("Length is %u\n", rclen);
 		if (bptr[1] != 2)
 			continue;
 
 		bptr += 2;
 		sp = (struct sap_data *) bptr;
-		while (result >= sizeof(struct sap_data))
+		while (rclen >= sizeof(struct sap_data))
 		{
 			int i;
 
@@ -83,7 +89,7 @@ main(int argc, char **argv)
 			       sp->sap_node[4],
 			       sp->sap_node[5],
 			       ntohs(sp->sap_sock));
-			result -= sizeof(struct sap_data);
+			rclen -= sizeof(struct sap_data);
 			sp++;
 		}
 	}