summaryrefslogtreecommitdiffstats
path: root/sys/netgraph/ng_bpf.c
diff options
context:
space:
mode:
authorarchie <archie@FreeBSD.org>2004-06-23 02:37:10 +0000
committerarchie <archie@FreeBSD.org>2004-06-23 02:37:10 +0000
commit65fa85e83db6067eb3c7c8fa6c44ffcaed666237 (patch)
treeb26bee77c71cf0cdc0e122e107151de02ddb5142 /sys/netgraph/ng_bpf.c
parent7e064ac98c6f16da00966149a4579ea7da989ab3 (diff)
downloadFreeBSD-src-65fa85e83db6067eb3c7c8fa6c44ffcaed666237.zip
FreeBSD-src-65fa85e83db6067eb3c7c8fa6c44ffcaed666237.tar.gz
Avoid calling bpf_filter() with len == 0, which causes a change in semantics
(it treats the buffer pointer as an mbuf pointer) and subsequent panic. MFC after: 3 days Reported by: Tony Hariman <tony@cbn.net.id>
Diffstat (limited to 'sys/netgraph/ng_bpf.c')
-rw-r--r--sys/netgraph/ng_bpf.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/sys/netgraph/ng_bpf.c b/sys/netgraph/ng_bpf.c
index 3dceea3..45c5023 100644
--- a/sys/netgraph/ng_bpf.c
+++ b/sys/netgraph/ng_bpf.c
@@ -403,7 +403,10 @@ ng_bpf_rcvdata(hook_p hook, item_p item)
data = mtod(m, u_char *);
/* Run packet through filter */
- len = bpf_filter(hip->prog->bpf_prog, data, totlen, totlen);
+ if (totlen == 0)
+ len = 0; /* don't call bpf_filter() with totlen == 0! */
+ else
+ len = bpf_filter(hip->prog->bpf_prog, data, totlen, totlen);
if (needfree)
FREE(data, M_NETGRAPH_BPF);
OpenPOWER on IntegriCloud