d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix ipip_output() to always set *mp to NULL on failure, even if 'm'

Browse Source 
is NULL, otherwise ipsec4_process_packet() may try to m_freem() a
bad pointer.

In ipsec4_process_packet(), don't try to m_freem() 'm' twice; ipip_output()
already did it.

Obtained from:	netbsd
This commit is contained in:
Sam Leffler 2004-01-20 22:45:10 +00:00
parent c58cde95d1
commit b5b47bc6fa
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/netipsec/ipsec_output.c
View File

@ -426,8 +426,11 @@ ipsec4_process_packet(
error = EFAULT;
}
if (error) {
if (mp)
if (mp) {
/* XXX: Should never happen! */
m_freem(mp);
}
m = NULL; /* ipip_output() already freed it */
goto bad;
}
m = mp, mp = NULL;

4
sys/netipsec/xform_ipip.c
View File

@ -526,7 +526,6 @@ ipip_output(
if (m == 0) {
DPRINTF(("%s: M_PREPEND failed\n", __func__));
ipipstat.ipips_hdrops++;
*mp = NULL;
error = ENOBUFS;
goto bad;
}
@ -610,7 +609,8 @@ ipip_output(
return 0;
bad:
if (m)
m_freem(m), *mp = NULL;
m_freem(m);
*mp = NULL;
return (error);
}