From: Michael Brown Date: Wed, 14 Oct 2020 13:05:03 +0000 (+0100) Subject: [lacp] Ignore (and do not echo) trailing padding on received packets X-Git-Tag: v1.21.1~79 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=388d657080d5088ab7832fcb0ec71a9a50c3a59f;p=thirdparty%2Fipxe.git [lacp] Ignore (and do not echo) trailing padding on received packets The LACP responder reuses the received I/O buffer to construct the response LACP (or marker) packet. Any received padding will therefore be unintentionally included within the response. Truncate the received I/O buffer to the expected length (which is already defined in a way to allow for future protocol expansion) before reusing it to construct the response. Reported-by: Tore Anderson Signed-off-by: Michael Brown --- diff --git a/src/net/eth_slow.c b/src/net/eth_slow.c index fa7a6e361..1103a49f3 100644 --- a/src/net/eth_slow.c +++ b/src/net/eth_slow.c @@ -286,6 +286,9 @@ static int eth_slow_rx ( struct io_buffer *iobuf, return -EINVAL; } + /* Strip any trailing padding */ + iob_unput ( iobuf, ( sizeof ( *eth_slow ) - iob_len ( iobuf ) ) ); + /* Handle according to subtype */ switch ( eth_slow->header.subtype ) { case ETH_SLOW_SUBTYPE_LACP: