[lacp] Fix stripping of trailing padding

The iob_unput() to strip any trailing padding is currently sign
reversed, causing the buffer to be extended rather than truncated.

This can result in uninitialised data within the receive I/O buffer
being passed to the LACP or marker receive handlers and subsequently
echoed back to the sender.

Fix by reversing the subtraction.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/net/eth_slow.c b/src/net/eth_slow.c
index e3b6a75a758da1bda874cc2de99d645062e3ee35..e4c78acd1886f09843328c88687a7d22106a7c2d 100644 (file)
--- a/src/net/eth_slow.c
+++ b/src/net/eth_slow.c
@@ -293,7 +293,7 @@ static int eth_slow_rx ( struct io_buffer *iobuf,
        }
 
        /* Strip any trailing padding */
-       iob_unput ( iobuf, ( sizeof ( *eth_slow ) - iob_len ( iobuf ) ) );
+       iob_unput ( iobuf, ( iob_len ( iobuf ) - sizeof ( *eth_slow ) ) );
 
        /* Handle according to subtype */
        switch ( eth_slow->header.subtype ) {