diff options
author | bde <bde@FreeBSD.org> | 2001-11-23 12:31:27 +0000 |
---|---|---|
committer | bde <bde@FreeBSD.org> | 2001-11-23 12:31:27 +0000 |
commit | d2d81413e2edf91cf5327d6bdb08b26fb9ac0e31 (patch) | |
tree | 41dcb275be4ede41a5246cf29db7bcf06c2c305d | |
parent | 700dcd9f734d8acb5ee2736d261c424983080af6 (diff) | |
download | FreeBSD-src-d2d81413e2edf91cf5327d6bdb08b26fb9ac0e31.zip FreeBSD-src-d2d81413e2edf91cf5327d6bdb08b26fb9ac0e31.tar.gz |
Fixed a buffer overrun. In my kernel configuration, tcp_syncache happens
to be followed by nfsnodehashtbl, so bzeroing callouts beyond the end of
tcp_syncache soon caused a null pointer panic when nfsnodehashtbl was
accessed.
-rw-r--r-- | sys/netinet/tcp_syncache.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c index 73860e0..89889b2 100644 --- a/sys/netinet/tcp_syncache.c +++ b/sys/netinet/tcp_syncache.c @@ -237,7 +237,7 @@ syncache_init(void) } /* Initialize the timer queues. */ - for (i = 0; i <= TCP_MAXRXTSHIFT; i++) { + for (i = 0; i <= SYNCACHE_MAXREXMTS; i++) { TAILQ_INIT(&tcp_syncache.timerq[i]); callout_init(&tcp_syncache.tt_timerq[i], 0); } |