diff options
| author | emax <emax@FreeBSD.org> | 2012-06-04 18:43:51 +0000 |
|---|---|---|
| committer | emax <emax@FreeBSD.org> | 2012-06-04 18:43:51 +0000 |
| commit | 682335a36dbe305f851b4c650e59ffcb1812bd40 (patch) | |
| tree | 7626a6f54772fa75ad61fc41bc240614a7036e27 /sys/netinet/tcp_input.c | |
| parent | 8c1e8547690a122e46ea46591307ded406f3f72b (diff) | |
| download | FreeBSD-src-682335a36dbe305f851b4c650e59ffcb1812bd40.zip FreeBSD-src-682335a36dbe305f851b4c650e59ffcb1812bd40.tar.gz | |
Plug more refcount leaks and possible NULL deref for interface
address list.
Submitted by: scottl@
MFC after: 3 days
Diffstat (limited to 'sys/netinet/tcp_input.c')
| -rw-r--r-- | sys/netinet/tcp_input.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c index 292dd6b..4d3234f 100644 --- a/sys/netinet/tcp_input.c +++ b/sys/netinet/tcp_input.c @@ -512,6 +512,8 @@ tcp6_input(struct mbuf **mp, int *offp, int proto) (caddr_t)&ip6->ip6_dst - (caddr_t)ip6); return IPPROTO_DONE; } + if (ia6) + ifa_free(&ia6->ia_ifa); tcp_input(m, *offp); return IPPROTO_DONE; @@ -1240,7 +1242,8 @@ relocked: rstreason = BANDLIM_RST_OPENPORT; goto dropwithreset; } - ifa_free(&ia6->ia_ifa); + if (ia6) + ifa_free(&ia6->ia_ifa); } #endif /* INET6 */ /* |
