DragonFlyBSD Kernel Audit
DF-0596 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/netgraph/pptpgre/ng_pptpgre.c b/sys/netgraph/pptpgre/ng_pptpgre.c
--- a/sys/netgraph/pptpgre/ng_pptpgre.c
+++ b/sys/netgraph/pptpgre/ng_pptpgre.c
@@ -511,8 +511,11 @@
 	/* Include sequence number if packet contains any data */
 	if (m != NULL) {
 		gre->hasSeq = 1;
-		a->timeSent[priv->xmitSeq - priv->recvAck]
-		    = ng_pptpgre_time(node);
+		{
+			u_int32_t _ts_idx = priv->xmitSeq - priv->recvAck;
+			if (_ts_idx < PPTP_XMIT_WIN)
+				a->timeSent[_ts_idx] = ng_pptpgre_time(node);
+		}
 		priv->xmitSeq++;
 		gre->data[0] = htonl(priv->xmitSeq);
 	}
@@ -672,6 +675,8 @@
 		if (PPTP_SEQ_DIFF(ack, a->winAck) >= 0
 		    && a->xmitWin < PPTP_XMIT_WIN) {
 			a->xmitWin++;
+			if (a->xmitWin > PPTP_XMIT_WIN)
+				a->xmitWin = PPTP_XMIT_WIN;
 			a->winAck = ack + a->xmitWin;
 		}