diff options
| author | dg <dg@FreeBSD.org> | 1996-09-08 13:45:49 +0000 |
|---|---|---|
| committer | dg <dg@FreeBSD.org> | 1996-09-08 13:45:49 +0000 |
| commit | da0f124b9e7bf5a37044ec27eab439e22c2832df (patch) | |
| tree | c5efe7a1e0257a9e0e59bcecbaafd945f7adf02d /sys/netinet/ip_input.c | |
| parent | e27a5690fecfbf627c379af7567d91414d1d784e (diff) | |
| download | FreeBSD-src-da0f124b9e7bf5a37044ec27eab439e22c2832df.zip FreeBSD-src-da0f124b9e7bf5a37044ec27eab439e22c2832df.tar.gz | |
Dequeue mbuf before freeing it. Fixes mbuf leak and a potential crash when
handling IP fragments.
Submitted by: Darren Reed <avalon@coombs.anu.edu.au>
Diffstat (limited to 'sys/netinet/ip_input.c')
| -rw-r--r-- | sys/netinet/ip_input.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sys/netinet/ip_input.c b/sys/netinet/ip_input.c index 375a0f4..9e65813 100644 --- a/sys/netinet/ip_input.c +++ b/sys/netinet/ip_input.c @@ -31,7 +31,7 @@ * SUCH DAMAGE. * * @(#)ip_input.c 8.2 (Berkeley) 1/4/94 - * $Id: ip_input.c,v 1.45 1996/07/10 19:44:25 julian Exp $ + * $Id: ip_input.c,v 1.46 1996/08/21 21:37:00 sos Exp $ */ #include "opt_ipfw.h" @@ -589,6 +589,8 @@ ip_reass(ip, fp) * if they are completely covered, dequeue them. */ while (q != (struct ipasfrag *)fp && ip->ip_off + ip->ip_len > q->ip_off) { + struct mbuf *m0; + i = (ip->ip_off + ip->ip_len) - q->ip_off; if (i < q->ip_len) { q->ip_len -= i; @@ -596,9 +598,10 @@ ip_reass(ip, fp) m_adj(dtom(q), i); break; } + m0 = dtom(q); q = q->ipf_next; - m_freem(dtom(q->ipf_prev)); ip_deq(q->ipf_prev); + m_freem(m0); } insert: |
