Fix a double-free in the 'hlen > m->m_len' sanity check.

Bug report by:	<james@towardex.com>
MFC after:	2 weeks
This commit is contained in:
Andre Oppermann 2004-11-09 09:40:32 +00:00
parent 140dd49673
commit 5e7b233055
Notes: svn2git 2020-12-20 02:59:44 +00:00
svn path=/head/; revision=137450

View File

@ -221,7 +221,7 @@ ip_fastforward(struct mbuf *m)
if (hlen > m->m_len) {
if ((m = m_pullup(m, hlen)) == 0) {
ipstat.ips_badhlen++;
goto drop;
return 1;
}
ip = mtod(m, struct ip *);
}