diff options
author | Toni Uhlig <matzeton@googlemail.com> | 2019-02-28 15:53:43 +0100 |
---|---|---|
committer | Toni Uhlig <matzeton@googlemail.com> | 2019-02-28 15:53:43 +0100 |
commit | 0aa06b84600a0b32b4e01dbc6900914a6dcedc0c (patch) | |
tree | bda88dea1738b1e468765f173243733daead11b6 | |
parent | e90f449ab3f44a2a3123d7ee6258b4fc1e3d910f (diff) |
fixed possible NULL ptr deref and division by zero
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
-rw-r--r-- | src/pkt.c | 6 |
1 files changed, 3 insertions, 3 deletions
@@ -369,7 +369,7 @@ void handle_data(icmp_echo_packet_t *pkt, int total_len, forward_desc_t *ring[], } return; } - if (pt_pkt->seq_no == *next_expected_seq) { + if (next_expected_seq && pt_pkt->seq_no == *next_expected_seq) { /* hmm, what happens if this test is true? */ if (!ring[*insert_idx]) { /* && pt_pkt->state == kProto_data */ /* pt_log(kLog_debug, "Queing data packet: %d\n", pt_pkt->seq_no); */ @@ -403,12 +403,12 @@ void handle_data(icmp_echo_packet_t *pkt, int total_len, forward_desc_t *ring[], d = s - r; if (d < 0) { /* This packet _may_ be old, or seq_no may have wrapped around */ d = (s+0xFFFF) - r; - if (d < window_size) { + if (window_size && d < window_size) { /* Counter has wrapped, so we should add this packet to the recv ring */ pos = ((*insert_idx)+d) % window_size; } } - else if (d < window_size) + else if (window_size && d < window_size) pos = ((*insert_idx)+d) % window_size; if (pos != -1) { |