Skip to content

Commit

Permalink
slirp: Fix packet expiration
Browse files Browse the repository at this point in the history
The two new variables "arp_requested" and "expiration_date" in the mbuf
structure have been added after the variable-sized "m_dat_" array. The
variables have to be added before the m_dat_ array instead.
Without this patch, the expiration_date gets clobbered by code that
accesses the m_dat_ array.
I experienced this problem with the code in slirp/tftp.c: The
tftp_send_data() function created a new packet with the m_get()
function (which fills-in a default expiration_date value). Then the
TFTP code cleared the data section of the packet, which accidentially
also cleared the expiration_date. This zeroed expiration_date then
finally causes the packet to be discarded during if_start(), so that
TFTP packets were not transmitted anymore.

[Jan: added comment as suggested by Fabien ]

CC: Fabien Chouteau <[email protected]>
Signed-off-by: Thomas Huth <[email protected]>
Signed-off-by: Jan Kiszka <[email protected]>
  • Loading branch information
huth authored and jan-kiszka committed Sep 28, 2011
1 parent 8d06d69 commit 2b44043
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions slirp/mbuf.h
Original file line number Diff line number Diff line change
Expand Up @@ -82,12 +82,13 @@ struct m_hdr {
struct mbuf {
struct m_hdr m_hdr;
Slirp *slirp;
bool arp_requested;
uint64_t expiration_date;
/* start of dynamic buffer area, must be last element */
union M_dat {
char m_dat_[1]; /* ANSI don't like 0 sized arrays */
char *m_ext_;
} M_dat;
bool arp_requested;
uint64_t expiration_date;
};

#define m_next m_hdr.mh_next
Expand Down

0 comments on commit 2b44043

Please sign in to comment.