summaryrefslogtreecommitdiffstats
path: root/sys/net/bpfdesc.h
diff options
context:
space:
mode:
authorrmacklem <rmacklem@FreeBSD.org>2009-08-12 16:27:51 +0000
committerrmacklem <rmacklem@FreeBSD.org>2009-08-12 16:27:51 +0000
commite0f9ca5ab5b6816a246a04faceaae64adbc9b8cd (patch)
tree8ffffe3b8759622a730a2e5cf589ff0fd9e6ee1b /sys/net/bpfdesc.h
parente934441f677085c7bc7f79208ae2f70f48164b66 (diff)
downloadFreeBSD-src-e0f9ca5ab5b6816a246a04faceaae64adbc9b8cd.zip
FreeBSD-src-e0f9ca5ab5b6816a246a04faceaae64adbc9b8cd.tar.gz
Add a check for a NULL mbuf ptr at the beginning of xdrmbuf_inline()
so that it returns failure instead of crashing when "m->m_len" is executed and m == NULL. The mbuf ptr can be NULL when a call to xdrmbuf_getbytes() gets the bytes it needs, but they are at the end of a short RPC reply. When this happens, xdrmbuf_getbytes() returns success, but advances the mbuf ptr (xdrs->x_private) to m_next, which is NULL. If this is followed by a call to xdrmbuf_getlong(), it calls xdrmbuf_inline(), which would cause a crash by accessing "m->m_len". Tested by: pho, serenity at exscape dot org Approved by: re (rwatson), kib (mentor)
Diffstat (limited to 'sys/net/bpfdesc.h')
0 files changed, 0 insertions, 0 deletions
OpenPOWER on IntegriCloud