diff options
| author | ru <ru@FreeBSD.org> | 2002-03-22 16:45:54 +0000 |
|---|---|---|
| committer | ru <ru@FreeBSD.org> | 2002-03-22 16:45:54 +0000 |
| commit | cb4688c90eead16a0ff16654cec050f9ee06304b (patch) | |
| tree | 0af413607ca5eca2f6e2c8d42cb082903ea99317 /sys/netinet/ip_icmp.c | |
| parent | 054cce2c17eeea8f911e8082b3e38d5343409c96 (diff) | |
| download | FreeBSD-src-cb4688c90eead16a0ff16654cec050f9ee06304b.zip FreeBSD-src-cb4688c90eead16a0ff16654cec050f9ee06304b.tar.gz | |
Prevent icmp_reflect() from calling ip_output() with a NULL route
pointer which will then result in the allocated route's reference
count never being decremented. Just flood ping the localhost and
watch refcnt of the 127.0.0.1 route with netstat(1).
Submitted by: jayanth
Back out ip_output.c,v 1.143 and ip_mroute.c,v 1.69 that allowed
ip_output() to be called with a NULL route pointer. The previous
paragraph shows why this was a bad idea in the first place.
MFC after: 0 days
Diffstat (limited to 'sys/netinet/ip_icmp.c')
| -rw-r--r-- | sys/netinet/ip_icmp.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/netinet/ip_icmp.c b/sys/netinet/ip_icmp.c index c671a0a..7042dd8 100644 --- a/sys/netinet/ip_icmp.c +++ b/sys/netinet/ip_icmp.c @@ -600,6 +600,8 @@ icmp_reflect(m) } t = ip->ip_dst; ip->ip_dst = ip->ip_src; + ro = &rt; + bzero(ro, sizeof(*ro)); /* * If the incoming packet was addressed directly to us, * use dst as the src for the reply. Otherwise (broadcast @@ -620,8 +622,6 @@ icmp_reflect(m) goto match; } } - ro = &rt; - bzero(ro, sizeof(*ro)); ia = ip_rtaddr(ip->ip_dst, ro); /* We need a route to do anything useful. */ if (ia == NULL) { |
