Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!utgpu!water!watmath!clyde!rutgers!sri-unix!sri-spam!ames!ucbcad!ucbvax!OKEEFFE.BERKELEY.EDU!bostic
From: bostic@OKEEFFE.BERKELEY.EDU.UUCP
Newsgroups: comp.bugs.4bsd.ucb-fixes
Subject: V1.25 (XNS driver can't handle PRC_QUENCH)
Message-ID: <8705112204.AA11505@okeeffe.Berkeley.EDU>
Date: Mon, 11-May-87 18:04:41 EDT
Article-I.D.: okeeffe.8705112204.AA11505
Posted: Mon May 11 18:04:41 1987
Date-Received: Wed, 13-May-87 07:26:09 EDT
Sender: daemon@ucbvax.BERKELEY.EDU
Distribution: world
Organization: The ARPA Internet
Lines: 40
Approved: ucb-fixes@okeeffe.berkeley.edu

Subject: XNS driver can't handle PRC_QUENCH
Index: sys/netns/spp_usrreq.c 4.3BSD

Description:
	When an XNS error protocol packet number 3 is received, the routine
	spp_ctlinput does not initialize the ns_address variable called na.
	spp_ctlinput then calls ns_pcbnotify and passes in the uninitialized
	variable.  This causes the kernel to crash.

	Error number 3 is called PRC_QUENCH in 4.3BSD and has the following
	descriptions in the XNS spec: "The destination cannot accept
	the packet due to resource limitations."

	It looks like 4.3BSD will have the same problem with PRC_ROUTDEAD
	messages.

Repeat-By:
	Sending an error protocol packet number 3 to the 4.3 driver.
	Either one of the database machines made by Britton Lee, Inc. can
	be forced to send an error protocol packet.

*** spp_usrreq.c.old	Mon May 11 14:54:24 1987
--- spp_usrreq.c.new	Mon May 11 15:00:14 1987
***************
*** 395,401 ****
  
  	case PRC_ROUTEDEAD:
  	case PRC_QUENCH:
! 		break;
  
  	case PRC_IFDOWN:
  	case PRC_HOSTDEAD:
--- 395,401 ----
  
  	case PRC_ROUTEDEAD:
  	case PRC_QUENCH:
! 		return;
  
  	case PRC_IFDOWN:
  	case PRC_HOSTDEAD: