diff --git a/src/libs/compat/freebsd_network/device_hooks.c b/src/libs/compat/freebsd_network/device_hooks.c index 9389a6b99e..4ab25af2f0 100644 --- a/src/libs/compat/freebsd_network/device_hooks.c +++ b/src/libs/compat/freebsd_network/device_hooks.c @@ -134,16 +134,17 @@ compat_read(void *cookie, off_t position, void *buffer, size_t *numBytes) } else if (status < B_OK) return status; - IF_LOCK(&ifp->receive_queue); - if (ifp->receive_queue.ifq_head != NULL - && ifp->receive_queue.ifq_head->m_pkthdr.len >= length) { - IF_UNLOCK(&ifp->receive_queue); - return E2BIG; - } - _IF_DEQUEUE(&ifp->receive_queue, mb); - IF_UNLOCK(&ifp->receive_queue); + IF_DEQUEUE(&ifp->receive_queue, mb); } while (mb == NULL); + if (mb->m_pkthdr.len > length) { + if_printf(ifp, "error reading packet: too large! (%d > %" B_PRIuSIZE ")\n", + mb->m_pkthdr.len, length); + m_freem(mb); + *numBytes = 0; + return E2BIG; + } + length = min_c(max_c((size_t)mb->m_pkthdr.len, 0), length); m_copydata(mb, 0, length, buffer);