d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fixup memory management for fetching options in ip_ctloutput()

Browse Source 
Submitted by:	Jason Eggleston <jason@eggnet.com>
Sponsored by:	Limelight Networks
Differential Revision:	https://reviews.freebsd.org/D14621
This commit is contained in:
sbruno 2018-07-14 16:19:46 +00:00
parent 98d05150ce
commit 388f09b02b
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/netinet/ip_output.c
View File

@ -1256,12 +1256,18 @@ ip_ctloutput(struct socket *so, struct sockopt *sopt)
switch (sopt->sopt_name) {
case IP_OPTIONS:
case IP_RETOPTS:
if (inp->inp_options)
if (inp->inp_options) {
unsigned long len = ulmin(inp->inp_options->m_len, sopt->sopt_valsize);
struct mbuf *options = malloc(len, M_TEMP, M_WAITOK);
INP_RLOCK(inp);
bcopy(inp->inp_options, options, len);
INP_RUNLOCK(inp);
error = sooptcopyout(sopt,
mtod(inp->inp_options,
mtod(options,
char *),
inp->inp_options->m_len);
else
len);
free(options, M_TEMP);
} else
sopt->sopt_valsize = 0;
break;