From owner-freebsd-hackers  Sun Jun  8 20:47:20 1997
Return-Path: <owner-hackers>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id UAA01799
          for hackers-outgoing; Sun, 8 Jun 1997 20:47:20 -0700 (PDT)
Received: from server.netplus.com.br ([200.247.23.97])
          by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id UAA01791
          for <freebsd-hackers@freebsd.org>; Sun, 8 Jun 1997 20:47:13 -0700 (PDT)
Received: from sergio.lenzi (dial02.netplus.com.br [200.247.23.101]) by server.netplus.com.br (8.7.6/8.7.3) with ESMTP id AAA14035 for <freebsd-hackers@freebsd.org>; Mon, 9 Jun 1997 00:38:30 GMT
Received: (from lenzi@localhost) by sergio.lenzi (8.8.5/8.8.3) id AAA01213; Mon, 9 Jun 1997 00:49:37 GMT
Date: Mon, 9 Jun 1997 00:49:34 +0000 ()
From: "Lenzi, Sergio" <lenzi@bsi.com.br>
X-Sender: lenzi@sergio
To: freebsd-hackers@freebsd.org
Subject: pppd & natd problem turnaround..
Message-ID: <Pine.BSF.3.91.970609004516.1188A-100000@sergio>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-hackers@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk


Hello all.

I have seen some messages dealing with pppd & natd panicing FreeBSD 2.2
systems.

The problem arises when a negative m->m_len value is reveived in function
pppfcs in module sys/net/ppp_tty.c 

A turnaround is to replace m_len to ZERO whenever is less then zero.

I know it is not the best, but it works for now.

Here is the patch.
--- ppp_tty.old	Sat Jun  7 18:10:32 1997
+++ ppp_tty.c	Sun Jun  8 21:51:26 1997
@@ -573,7 +573,7 @@
     register u_char *cp;
     register int len;
 {
-    while (len--)
+    while (len-- > 0)
 	fcs = PPP_FCS(fcs, *cp++);
     return (fcs);
 }
@@ -775,6 +775,8 @@
 		sc->sc_if.if_obytes = sc->sc_bytessent;
 		break;
 	    }
+	    if (m->m_len < 0) 
+		m->m_len=0;
 	    sc->sc_outfcs = pppfcs(sc->sc_outfcs, mtod(m, u_char *), m->m_len);
 	}
 


Sergio Lenzi.

Unix consult.