Fix two places in the ICMP6 code where we could dereference a NULL pointer
in the icmp6_input() function. When processing an ICMP6_ECHO_REQUEST, if IP6_EXTHDR_GET fails, it will set nicmp6 and n to NULL. Therefore, we should condition our modification to nicmp6 on n being not NULL. And, when processing an ICMP6_WRUREQUEST in the (mode != FQDN) case, if m_dup_pkthdr() fails, the code will set n to NULL. However, the very next line dereferences n. Therefore, when m_dup_pkthdr() fails, we should discontinue further processing and follow the same path as when m_gethdr() fails. Reported by: clang static analyzer Reviewed by: ae MFC after: 2 weeks Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D10941
This commit is contained in:
parent
382a6bbcf1
commit
fb04394554
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=319215
@ -597,9 +597,9 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
|
||||
sizeof(*nicmp6));
|
||||
noff = off;
|
||||
}
|
||||
nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
|
||||
nicmp6->icmp6_code = 0;
|
||||
if (n) {
|
||||
nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
|
||||
nicmp6->icmp6_code = 0;
|
||||
ICMP6STAT_INC(icp6s_reflect);
|
||||
ICMP6STAT_INC(icp6s_outhist[ICMP6_ECHO_REPLY]);
|
||||
icmp6_reflect(n, noff);
|
||||
@ -689,6 +689,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
|
||||
*/
|
||||
m_free(n);
|
||||
n = NULL;
|
||||
break;
|
||||
}
|
||||
maxhlen = M_TRAILINGSPACE(n) -
|
||||
(sizeof(*nip6) + sizeof(*nicmp6) + 4);
|
||||
|
Loading…
Reference in New Issue
Block a user