X-Git-Url: https://git.ozlabs.org/?p=ppp.git;a=blobdiff_plain;f=modules%2Fvjcompress.c;h=66d3402886c22cdd81dc27b7996a81e1e7a150c6;hp=ef2c9c487fb619985b7a604f9b10bd5d00d6f999;hb=bff5da40466cebce6ae413e3ee3d38003e689fb8;hpb=5079a982cc7f44cf230df1bec5520cbb9f5631ad

diff --git a/modules/vjcompress.c b/modules/vjcompress.c
index ef2c9c4..66d3402 100644
--- a/modules/vjcompress.c
+++ b/modules/vjcompress.c
@@ -23,19 +23,33 @@
  * Modified June 1993 by Paul Mackerras, paulus@cs.anu.edu.au,
  * so that the entire packet being decompressed doesn't have
  * to be in contiguous memory (just the compressed header).
+ */
+
+/*
+ * This version is used under SunOS 4.x, Digital UNIX, AIX 4.x,
+ * and SVR4 systems including Solaris 2.
  *
- * $Id: vjcompress.c,v 1.4 1994/12/08 00:35:33 paulus Exp $
+ * $Id: vjcompress.c,v 1.9 1996/06/26 00:53:17 paulus Exp $
  */
 
 #include <sys/types.h>
 #include <sys/param.h>
 
+#ifdef SVR4
+#ifndef __GNUC__
+#include <sys/byteorder.h>	/* for ntohl, etc. */
+#else
+/* make sure we don't get the gnu "fixed" one! */
+#include "/usr/include/sys/byteorder.h"
+#endif
+#endif
+
 #ifdef __osf__
 #include <net/net_globals.h>
 #endif
 #include <netinet/in.h>
 
-#ifdef __aix4__
+#ifdef AIX4
 #define _NETINET_IN_SYSTM_H_
 typedef u_long  n_long;
 #else
@@ -121,19 +135,23 @@ vj_compress_init(comp, max_state)
 
 #define DECODEL(f) { \
 	if (*cp == 0) {\
-		(f) = htonl(ntohl(f) + ((cp[1] << 8) | cp[2])); \
+		u_int32_t tmp = ntohl(f) + ((cp[1] << 8) | cp[2]); \
+		(f) = htonl(tmp); \
 		cp += 3; \
 	} else { \
-		(f) = htonl(ntohl(f) + (u_int32_t)*cp++); \
+		u_int32_t tmp = ntohl(f) + (u_int32_t)*cp++; \
+		(f) = htonl(tmp); \
 	} \
 }
 
 #define DECODES(f) { \
 	if (*cp == 0) {\
-		(f) = htons(ntohs(f) + ((cp[1] << 8) | cp[2])); \
+		u_short tmp = ntohs(f) + ((cp[1] << 8) | cp[2]); \
+		(f) = htons(tmp); \
 		cp += 3; \
 	} else { \
-		(f) = htons(ntohs(f) + (u_int32_t)*cp++); \
+		u_short tmp = ntohs(f) + (u_int32_t)*cp++; \
+		(f) = htons(tmp); \
 	} \
 }
 
@@ -412,8 +430,9 @@ vj_uncompress_err(comp)
  * "Uncompress" a packet of type TYPE_UNCOMPRESSED_TCP.
  */
 int
-vj_uncompress_uncomp(buf, comp)
+vj_uncompress_uncomp(buf, buflen, comp)
     u_char *buf;
+    int buflen;
     struct vjcompress *comp;
 {
     register u_int hlen;
@@ -421,7 +440,12 @@ vj_uncompress_uncomp(buf, comp)
     register struct ip *ip;
 
     ip = (struct ip *) buf;
-    if (ip->ip_p >= MAX_STATES) {
+    hlen = getip_hl(*ip) << 2;
+    if (ip->ip_p >= MAX_STATES
+	|| hlen + sizeof(struct tcphdr) > buflen
+	|| (hlen += getth_off(*((struct tcphdr *)&((char *)ip)[hlen])) << 2)
+	    > buflen
+	|| hlen > MAX_HDR) {
 	comp->flags |= VJF_TOSS;
 	INCR(vjs_errorin);
 	return (0);
@@ -429,9 +453,6 @@ vj_uncompress_uncomp(buf, comp)
     cs = &comp->rstate[comp->last_recv = ip->ip_p];
     comp->flags &=~ VJF_TOSS;
     ip->ip_p = IPPROTO_TCP;
-    hlen = getip_hl(*ip);
-    hlen += getth_off(*((struct tcphdr *)&((int *)ip)[hlen]));
-    hlen <<= 2;
     BCOPY(ip, &cs->cs_ip, hlen);
     cs->cs_hlen = hlen;
     INCR(vjs_uncompressedin);
@@ -460,6 +481,7 @@ vj_uncompress_tcp(buf, buflen, total_len, comp, hdrp, hlenp)
     register struct cstate *cs;
     register u_short *bp;
     register u_int vjlen;
+    register u_int32_t tmp;
 
     INCR(vjs_compressedin);
     cp = buf;
@@ -494,15 +516,19 @@ vj_uncompress_tcp(buf, buflen, total_len, comp, hdrp, hlenp)
     switch (changes & SPECIALS_MASK) {
     case SPECIAL_I:
 	{
-	    register u_int i = ntohs(cs->cs_ip.ip_len) - cs->cs_hlen;
-	    th->th_ack = htonl(ntohl(th->th_ack) + i);
-	    th->th_seq = htonl(ntohl(th->th_seq) + i);
+	    register u_int32_t i = ntohs(cs->cs_ip.ip_len) - cs->cs_hlen;
+	    /* some compilers can't nest inline assembler.. */
+	    tmp = ntohl(th->th_ack) + i;
+	    th->th_ack = htonl(tmp);
+	    tmp = ntohl(th->th_seq) + i;
+	    th->th_seq = htonl(tmp);
 	}
 	break;
 
     case SPECIAL_D:
-	th->th_seq = htonl(ntohl(th->th_seq) + ntohs(cs->cs_ip.ip_len)
-			   - cs->cs_hlen);
+	/* some compilers can't nest inline assembler.. */
+	tmp = ntohl(th->th_seq) + ntohs(cs->cs_ip.ip_len) - cs->cs_hlen;
+	th->th_seq = htonl(tmp);
 	break;
 
     default:
@@ -521,8 +547,10 @@ vj_uncompress_tcp(buf, buflen, total_len, comp, hdrp, hlenp)
     }
     if (changes & NEW_I) {
 	DECODES(cs->cs_ip.ip_id);
-    } else
-	cs->cs_ip.ip_id = htons(ntohs(cs->cs_ip.ip_id) + 1);
+    } else {
+	cs->cs_ip.ip_id = ntohs(cs->cs_ip.ip_id) + 1;
+	cs->cs_ip.ip_id = htons(cs->cs_ip.ip_id);
+    }
 
     /*
      * At this point, cp points to the first byte of data in the