urndis(4) Frame length validation

[Loganaden Velvindron]

Hi, this diff also discards packets larger than maximum buffer size.

Please test.

Index: src/sys/dev/usb/if_urndis.c
===================================================================
RCS file: /cvs/src/sys/dev/usb/if_urndis.c,v
retrieving revision 1.29
diff -u -p -r1.29 if_urndis.c
--- src/sys/dev/usb/if_urndis.c 25 Jan 2011 20:03:35 -0000      1.29
+++ src/sys/dev/usb/if_urndis.c 20 Mar 2011 05:22:55 -0000
@@ -801,12 +801,13 @@ urndis_decap(struct urndis_softc *sc, st
                DPRINTF(("%s: urndis_decap buffer size left %u\n", DEVNAME(sc),
                    len));
 
-               if (len < sizeof(*msg)) {
+               if (len < sizeof(*msg) || len > RNDIS_BUFSZ) {
                        printf("%s: urndis_decap invalid buffer len %u < "
-                           "minimum header %u\n",
+                           "minimum header %u maximum size %d\n",
                            DEVNAME(sc),
                            len,
-                           sizeof(*msg));
+                           sizeof(*msg),
+                           RNDIS_BUFSZ);
                        return;
                }