diff options
| author | rwatson <rwatson@FreeBSD.org> | 2006-01-15 12:09:03 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2006-01-15 12:09:03 +0000 |
| commit | a447e5c6e294997147e59a8dd766c8047ae24da8 (patch) | |
| tree | 7b9e64bbe82d5aa4ebbc43f413e20781be107171 /sys/dev/an/if_an.c | |
| parent | 428bff839a9349d39cb7f72cfed84283cf8e5722 (diff) | |
| download | FreeBSD-src-a447e5c6e294997147e59a8dd766c8047ae24da8.zip FreeBSD-src-a447e5c6e294997147e59a8dd766c8047ae24da8.tar.gz | |
Don't leak mbufs and mbuf clusters in several error-handling situations
in the if_an receive routine.
Found with: Coverity Prevent (tm)
MFC after: 1 week
Diffstat (limited to 'sys/dev/an/if_an.c')
| -rw-r--r-- | sys/dev/an/if_an.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/sys/dev/an/if_an.c b/sys/dev/an/if_an.c index 3824913..fd34900 100644 --- a/sys/dev/an/if_an.c +++ b/sys/dev/an/if_an.c @@ -937,6 +937,7 @@ an_rxeof(struct an_softc *sc) /* Read NIC frame header */ if (an_read_data(sc, id, 0, (caddr_t)&rx_frame, sizeof(rx_frame))) { + m_freem(m); ifp->if_ierrors++; return; } @@ -945,16 +946,19 @@ an_rxeof(struct an_softc *sc) if (an_read_data(sc, id, 0x34, (caddr_t)&rx_frame_802_3, sizeof(rx_frame_802_3))) { + m_freem(m); ifp->if_ierrors++; return; } if (rx_frame_802_3.an_rx_802_3_status != 0) { + m_freem(m); ifp->if_ierrors++; return; } /* Check for insane frame length */ len = rx_frame_802_3.an_rx_802_3_payload_len; if (len > sizeof(sc->buf_802_11)) { + m_freem(m); printf("an%d: oversized packet " "received (%d, %d)\n", sc->an_unit, len, MCLBYTES); |
