some extra debugging, fix a stupid if (a = b)

[ppp.git] / modules / vjcompress.c

diff --git a/modules/vjcompress.c b/modules/vjcompress.c
index 32a9c93e97cf9ea52eb35a89d4427b1d58d6b80a..66d3402886c22cdd81dc27b7996a81e1e7a150c6 100644 (file)
--- a/modules/vjcompress.c
+++ b/modules/vjcompress.c
@@ -23,14 +23,19 @@
  * Modified June 1993 by Paul Mackerras, paulus@cs.anu.edu.au,
  * so that the entire packet being decompressed doesn't have
  * to be in contiguous memory (just the compressed header).
+ */
+
+/*
+ * This version is used under SunOS 4.x, Digital UNIX, AIX 4.x,
+ * and SVR4 systems including Solaris 2.
  *
- * $Id: vjcompress.c,v 1.5 1995/05/19 03:48:34 paulus Exp $
+ * $Id: vjcompress.c,v 1.9 1996/06/26 00:53:17 paulus Exp $
  */
 
 #include <sys/types.h>
 #include <sys/param.h>
 
-#ifdef __svr4__
+#ifdef SVR4
 #ifndef __GNUC__
 #include <sys/byteorder.h>     /* for ntohl, etc. */
 #else
@@ -44,7 +49,7 @@
 #endif
 #include <netinet/in.h>
 
-#ifdef __aix4__
+#ifdef AIX4
 #define _NETINET_IN_SYSTM_H_
 typedef u_long  n_long;
 #else
@@ -130,19 +135,23 @@ vj_compress_init(comp, max_state)
 
 #define DECODEL(f) { \
        if (*cp == 0) {\
-               (f) = htonl(ntohl(f) + ((cp[1] << 8) | cp[2])); \
+               u_int32_t tmp = ntohl(f) + ((cp[1] << 8) | cp[2]); \
+               (f) = htonl(tmp); \
                cp += 3; \
        } else { \
-               (f) = htonl(ntohl(f) + (u_int32_t)*cp++); \
+               u_int32_t tmp = ntohl(f) + (u_int32_t)*cp++; \
+               (f) = htonl(tmp); \
        } \
 }
 
 #define DECODES(f) { \
        if (*cp == 0) {\
-               (f) = htons(ntohs(f) + ((cp[1] << 8) | cp[2])); \
+               u_short tmp = ntohs(f) + ((cp[1] << 8) | cp[2]); \
+               (f) = htons(tmp); \
                cp += 3; \
        } else { \
-               (f) = htons(ntohs(f) + (u_int32_t)*cp++); \
+               u_short tmp = ntohs(f) + (u_int32_t)*cp++; \
+               (f) = htons(tmp); \
        } \
 }
 
@@ -421,8 +430,9 @@ vj_uncompress_err(comp)
  * "Uncompress" a packet of type TYPE_UNCOMPRESSED_TCP.
  */
 int
-vj_uncompress_uncomp(buf, comp)
+vj_uncompress_uncomp(buf, buflen, comp)
     u_char *buf;
+    int buflen;
     struct vjcompress *comp;
 {
     register u_int hlen;
@@ -430,7 +440,12 @@ vj_uncompress_uncomp(buf, comp)
     register struct ip *ip;
 
     ip = (struct ip *) buf;
-    if (ip->ip_p >= MAX_STATES) {
+    hlen = getip_hl(*ip) << 2;
+    if (ip->ip_p >= MAX_STATES
+       || hlen + sizeof(struct tcphdr) > buflen
+       || (hlen += getth_off(*((struct tcphdr *)&((char *)ip)[hlen])) << 2)
+           > buflen
+       || hlen > MAX_HDR) {
        comp->flags |= VJF_TOSS;
        INCR(vjs_errorin);
        return (0);
@@ -438,9 +453,6 @@ vj_uncompress_uncomp(buf, comp)
     cs = &comp->rstate[comp->last_recv = ip->ip_p];
     comp->flags &=~ VJF_TOSS;
     ip->ip_p = IPPROTO_TCP;
-    hlen = getip_hl(*ip);
-    hlen += getth_off(*((struct tcphdr *)&((int *)ip)[hlen]));
-    hlen <<= 2;
     BCOPY(ip, &cs->cs_ip, hlen);
     cs->cs_hlen = hlen;
     INCR(vjs_uncompressedin);
@@ -469,6 +481,7 @@ vj_uncompress_tcp(buf, buflen, total_len, comp, hdrp, hlenp)
     register struct cstate *cs;
     register u_short *bp;
     register u_int vjlen;
+    register u_int32_t tmp;
 
     INCR(vjs_compressedin);
     cp = buf;
@@ -503,15 +516,19 @@ vj_uncompress_tcp(buf, buflen, total_len, comp, hdrp, hlenp)
     switch (changes & SPECIALS_MASK) {
     case SPECIAL_I:
        {
-           register u_int i = ntohs(cs->cs_ip.ip_len) - cs->cs_hlen;
-           th->th_ack = htonl(ntohl(th->th_ack) + i);
-           th->th_seq = htonl(ntohl(th->th_seq) + i);
+           register u_int32_t i = ntohs(cs->cs_ip.ip_len) - cs->cs_hlen;
+           /* some compilers can't nest inline assembler.. */
+           tmp = ntohl(th->th_ack) + i;
+           th->th_ack = htonl(tmp);
+           tmp = ntohl(th->th_seq) + i;
+           th->th_seq = htonl(tmp);
        }
        break;
 
     case SPECIAL_D:
-       th->th_seq = htonl(ntohl(th->th_seq) + ntohs(cs->cs_ip.ip_len)
-                          - cs->cs_hlen);
+       /* some compilers can't nest inline assembler.. */
+       tmp = ntohl(th->th_seq) + ntohs(cs->cs_ip.ip_len) - cs->cs_hlen;
+       th->th_seq = htonl(tmp);
        break;
 
     default:
@@ -530,8 +547,10 @@ vj_uncompress_tcp(buf, buflen, total_len, comp, hdrp, hlenp)
     }
     if (changes & NEW_I) {
        DECODES(cs->cs_ip.ip_id);
-    } else
-       cs->cs_ip.ip_id = htons(ntohs(cs->cs_ip.ip_id) + 1);
+    } else {
+       cs->cs_ip.ip_id = ntohs(cs->cs_ip.ip_id) + 1;
+       cs->cs_ip.ip_id = htons(cs->cs_ip.ip_id);
+    }
 
     /*
      * At this point, cp points to the first byte of data in the