diff options
| author | andre <andre@FreeBSD.org> | 2006-01-18 14:24:39 +0000 |
|---|---|---|
| committer | andre <andre@FreeBSD.org> | 2006-01-18 14:24:39 +0000 |
| commit | a08da7cd98bf2aff1c327d1becbb7614c27a40b4 (patch) | |
| tree | 4e69a0c80481917df0c10480c9cecc38671545fd /sys/net/if_arcsubr.c | |
| parent | 11141440e8f44bc40ad6efe297d1e4342166f159 (diff) | |
| download | FreeBSD-src-a08da7cd98bf2aff1c327d1becbb7614c27a40b4.zip FreeBSD-src-a08da7cd98bf2aff1c327d1becbb7614c27a40b4.tar.gz | |
Return mbuf pointer or NULL from ip_fastforward() as the mbuf pointer
may have changed by m_pullup() during fastforward processing.
While this is a bug it is actually never triggered in real world
situations and it is not remotely exploitable.
Found by: Coverity Prevent(tm)
Coverity ID: CID780
Sponsored by: TCP/IP Optimization Fundraise 2005
Diffstat (limited to 'sys/net/if_arcsubr.c')
| -rw-r--r-- | sys/net/if_arcsubr.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/net/if_arcsubr.c b/sys/net/if_arcsubr.c index 6cdb951..f3c00cd 100644 --- a/sys/net/if_arcsubr.c +++ b/sys/net/if_arcsubr.c @@ -559,14 +559,14 @@ arc_input(ifp, m) #ifdef INET case ARCTYPE_IP: m_adj(m, ARC_HDRNEWLEN); - if (ip_fastforward(m)) + if ((m = ip_fastforward(m)) == NULL) return; isr = NETISR_IP; break; case ARCTYPE_IP_OLD: m_adj(m, ARC_HDRLEN); - if (ip_fastforward(m)) + if ((m = ip_fastforward(m)) == NULL) return; isr = NETISR_IP; break; |
