Fix a logic error in uipc_ready_scan().
When processing the last record in a socket buffer, take care to avoid a NULL pointer dereference when advancing the record iterator. Reported by: syzbot+6a689cc9c27bd265237a@syzkaller.appspotmail.com Fixes: r359778 MFC after: 1 week Sponsored by: The FreeBSD Foundation
This commit is contained in:
parent
d2090a40d0
commit
1b778ba260
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=363682
@ -1279,7 +1279,8 @@ uipc_ready_scan(struct socket *so, struct mbuf *m, int count, int *errorp)
|
||||
mb = mb->m_next;
|
||||
if (mb == NULL) {
|
||||
mb = n;
|
||||
n = mb->m_nextpkt;
|
||||
if (mb != NULL)
|
||||
n = mb->m_nextpkt;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user