From 14b0498cfa749dbdde62f9e6b6f3b97dacdb173b Mon Sep 17 00:00:00 2001 From: Michael Lotz Date: Sat, 17 Nov 2018 00:24:27 +0100 Subject: [PATCH] arp: Trim the reply buffer to the filled length. We reuse the incoming request buffer to send our reply. We did however not trim that buffer to the length we actually filled out, allowing any extraneous incoming data to remain in that buffer and be sent back. --- src/add-ons/kernel/network/datalink_protocols/arp/arp.cpp | 1 + 1 file changed, 1 insertion(+) diff --git a/src/add-ons/kernel/network/datalink_protocols/arp/arp.cpp b/src/add-ons/kernel/network/datalink_protocols/arp/arp.cpp index 9f7fd8bfbb..0124274c75 100644 --- a/src/add-ons/kernel/network/datalink_protocols/arp/arp.cpp +++ b/src/add-ons/kernel/network/datalink_protocols/arp/arp.cpp @@ -607,6 +607,7 @@ handle_arp_request(net_buffer *buffer, arp_header &header) buffer->flags = 0; // make sure this won't be a broadcast message + gBufferModule->trim(buffer, sizeof(arp_header)); return entry->protocol->next->module->send_data(entry->protocol->next, buffer); }