[comp.protocols.appletalk] CAP bug report

CUSTEAD@sask.usask.ca (11/04/88)

I reported this bug to Charlie Kim and he asked me to post it to the list.

Problem:  atis was dying with a SIGSEGV every few hours.

Diagnosis:  A DDP packet was arriving with size less than ddpSize.
This meant that the packet had no body for the checksum routine to work on.
do_ddp_chksum was called with a negative length, and with disastrous results.

Solution:  Discard short packets prior to checksum verification.
(Apply the following patch.)

*** abddp.c_prev Fri Oct 28 23:49:02 1988
--- abddp.c      Fri Oct 28 23:49:46 1988
***************
*** 354,360 ****

    ddp = (DDP *)iov->iov_base; /* know aligned okay */
    len = ntohs(ddp->length) & 0x3ff; /* get the "real" length */
!   if (plen < len) {           /* not enought data? */
      if (dbug.db_ddp)
        fprintf(stderr, "BAD PACKET: ddp reports more data than came in\n");
      return;                   /* drop pkt */
--- 354,360 ----

    ddp = (DDP *)iov->iov_base; /* know aligned okay */
    len = ntohs(ddp->length) & 0x3ff; /* get the "real" length */
!   if (plen < len || len < ddpSize) {          /* not enought data? */
      if (dbug.db_ddp)
        fprintf(stderr, "BAD PACKET: ddp reports more data than came in\n");
      return;                   /* drop pkt */

=====================================

Note: The error message should really be changed.

        Larry R. Custead
        Univ of Saskatchewan
        custead@sask.usask.ca

p.s.  On a different topic:  We have the unix side of macdump running.
Could someone send me the mac program to restore files?  (I have the
'dumper' driver on the mac, but it appears that something more is needed
for restoring?)