- Fix potential double mbuf free: M_PREPEND may free mbuf chain and return

NULL but item will still have the reference ot the mbuf chain and will free
it upon destruction.
- Fix memory leak (unfree'd item on error path).
This commit is contained in:
fjoe 2011-11-06 05:24:54 +00:00
parent e5bafa39b1
commit c518069229

View File

@ -153,7 +153,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item)
int error;
priv = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
m = NGI_M(item);
NGI_GET_M(item, m);
outhook = NULL;
padding = 0;
@ -170,6 +170,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item)
if (m->m_len < sizeof(struct atmllc) + ETHER_HDR_LEN) {
m = m_pullup(m, sizeof(struct atmllc) + ETHER_HDR_LEN);
if (m == NULL) {
NG_FREE_ITEM(item);
return (ENOMEM);
}
}
@ -236,6 +237,7 @@ ng_atmllc_rcvdata(hook_p hook, item_p item)
}
if (outhook == NULL) {
NG_FREE_M(m);
NG_FREE_ITEM(item);
return (0);
}