[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[lwip-users] [lwip] uIP tapdev_send() again
From: |
Felipe Massia |
Subject: |
[lwip-users] [lwip] uIP tapdev_send() again |
Date: |
Wed, 08 Jan 2003 23:20:08 -0000 |
Hello!
In unix/tapdev.c:tapdev_send():
140 iov[0].iov_base = uip_buf;
141 iov[0].iov_len = 40 + UIP_LLH_LEN;
142 iov[1].iov_base = (char *)uip_appdata;
143 iov[1].iov_len = uip_len - 40 + UIP_LLH_LEN;
should not be (untested code :-)
141 iov[0].iov_len = (uip_len < 40 + UIP_LLH_LEN) ? uip_len : (40 +
UIP_LLH_LEN);
...
143 iov[1].iov_len = uip_len - (40 + UIP_LLH_LEN);
?
It could send some invalid data of size 2*UIP_LLH_LEN. And sometimes
uip_len is less than 40+UIP_LLH_LEN (arp replies, 42 bytes). But this is
not a problem because writev() won't write the second iov since iov_len
is negative.
As I'm using the alternative implementation for writev() (writev
misbehaves with my tap driver) I'm just predicting what would happen.
[]s
--
Felipe
[This message was sent through the lwip discussion list.]
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [lwip-users] [lwip] uIP tapdev_send() again,
Felipe Massia <=