From owner-freebsd-hackers Fri Jun 6 14:20:39 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.5/8.8.5) id OAA12873 for hackers-outgoing; Fri, 6 Jun 1997 14:20:39 -0700 (PDT) Received: from awfulhak.demon.co.uk (awfulhak.demon.co.uk [158.152.17.1]) by hub.freebsd.org (8.8.5/8.8.5) with ESMTP id OAA12860 for ; Fri, 6 Jun 1997 14:20:27 -0700 (PDT) Received: from awfulhak.demon.co.uk (localhost [127.0.0.1]) by awfulhak.demon.co.uk (8.8.5/8.8.5) with ESMTP id WAA20815; Fri, 6 Jun 1997 22:17:57 +0100 (BST) Message-Id: <199706062117.WAA20815@awfulhak.demon.co.uk> X-Mailer: exmh version 1.6.9 8/22/96 To: "Lenzi, Sergio" cc: freebsd-hackers@FreeBSD.ORG Subject: Re: pppd problem when using natd (cont.). In-reply-to: Your message of "Fri, 06 Jun 1997 15:28:46 -0000." Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Fri, 06 Jun 1997 22:17:57 +0100 From: Brian Somers Sender: owner-hackers@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk > > The panic on module ppp seems to be in pppfcs call. > > The system panics while using natd (network address translator) and pppd > > > (line 570 of file /usr/src/sys/net/ppp_tty.c). > > It arises when ppp_fcs receive a len less than zero. > > static u_short > pppfcs(fcs, cp, len) > register u_short fcs; > register u_char *cp; > register int len; > { > while (len--) > fcs = PPP_FCS(fcs, *cp++); > return (fcs); > } > > Can someone please guide me what to do if this function receives > len < 0 ??? > > In a test with a printf... it receives len = -17. > > Thanks for any help. Looks like the/a cause. cp will get de-referenced until len wraps - that means panic in my book. I wonder why it's being called with -17. Are you able to commit, or would you like me to take a look at fixing this (or Joerg, you've been in there recently, do you want to wear the hat) ? > Sergio Lenzi. > > Unix consult. > -- Brian , Don't _EVER_ lose your sense of humour....