diff options
| author | andre <andre@FreeBSD.org> | 2004-11-06 10:47:36 +0000 |
|---|---|---|
| committer | andre <andre@FreeBSD.org> | 2004-11-06 10:47:36 +0000 |
| commit | becc212fd34eb2fe45097dd6e04187cfd3666a0b (patch) | |
| tree | 1b06053feed75a55ac5fc1dc29144234c2690bcb | |
| parent | 1cf63fa355207bac9cee8dcf4a40bd80a125db5e (diff) | |
| download | FreeBSD-src-becc212fd34eb2fe45097dd6e04187cfd3666a0b.zip FreeBSD-src-becc212fd34eb2fe45097dd6e04187cfd3666a0b.tar.gz | |
Fix a double-free in the 'm->m_len < sizeof (struct ip)' sanity check.
Bug report by: <james@towardex.com>
MFC after: 2 weeks
| -rw-r--r-- | sys/netinet/ip_fastfwd.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/netinet/ip_fastfwd.c b/sys/netinet/ip_fastfwd.c index 1ad7d45..f0add29 100644 --- a/sys/netinet/ip_fastfwd.c +++ b/sys/netinet/ip_fastfwd.c @@ -195,9 +195,9 @@ ip_fastforward(struct mbuf *m) * Is first mbuf large enough for ip header and is header present? */ if (m->m_len < sizeof (struct ip) && - (m = m_pullup(m, sizeof (struct ip))) == 0) { + (m = m_pullup(m, sizeof (struct ip))) == NULL) { ipstat.ips_toosmall++; - goto drop; + return 1; /* mbuf already free'd */ } ip = mtod(m, struct ip *); |
