diff options
| author | philip <philip@FreeBSD.org> | 2008-11-17 07:09:40 +0000 |
|---|---|---|
| committer | philip <philip@FreeBSD.org> | 2008-11-17 07:09:40 +0000 |
| commit | acf5df9093fc6223b53f02480ab96fc458cf96ce (patch) | |
| tree | 4c9958447ae01c4591812d7722d8e10937548efe /sys/dev/glxsb/glxsb.c | |
| parent | 1f631eadf5d95ca7f65c5126fdcd3a117cbf9f5e (diff) | |
| download | FreeBSD-src-acf5df9093fc6223b53f02480ab96fc458cf96ce.zip FreeBSD-src-acf5df9093fc6223b53f02480ab96fc458cf96ce.tar.gz | |
Fix two possible (but unlikely) NULL-pointer dereferences in glxsb(4).
Spotted by: Coverity
MFC after: 1 week
Diffstat (limited to 'sys/dev/glxsb/glxsb.c')
| -rw-r--r-- | sys/dev/glxsb/glxsb.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/sys/dev/glxsb/glxsb.c b/sys/dev/glxsb/glxsb.c index c521cf5..1af3439 100644 --- a/sys/dev/glxsb/glxsb.c +++ b/sys/dev/glxsb/glxsb.c @@ -358,7 +358,8 @@ glxsb_detach(device_t dev) return (EBUSY); } } - while ((ses = TAILQ_FIRST(&sc->sc_sessions)) != NULL) { + while (!TAILQ_EMPTY(&sc->sc_sessions)) { + ses = TAILQ_FIRST(&sc->sc_sessions); TAILQ_REMOVE(&sc->sc_sessions, ses, ses_next); free(ses, M_GLXSB); } @@ -867,8 +868,11 @@ glxsb_crypto_process(device_t dev, struct cryptop *crp, int hint) enccrd = maccrd = NULL; - if (crp == NULL || - crp->crp_callback == NULL || crp->crp_desc == NULL) { + /* Sanity check. */ + if (crp == NULL) + return (EINVAL); + + if (crp->crp_callback == NULL || crp->crp_desc == NULL) { error = EINVAL; goto fail; } |
