diff options
| author | rwatson <rwatson@FreeBSD.org> | 2006-01-13 23:53:23 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2006-01-13 23:53:23 +0000 |
| commit | e68bf7df89ab1ca8350fadf2e81c907eaed56c6e (patch) | |
| tree | ad6ccb2bf2104d6fcdf1cbec16f10853f33d6275 /sys/netinet6 | |
| parent | ab38cf45fb259c683ad45977883ffc339b10e9ec (diff) | |
| download | FreeBSD-src-e68bf7df89ab1ca8350fadf2e81c907eaed56c6e.zip FreeBSD-src-e68bf7df89ab1ca8350fadf2e81c907eaed56c6e.tar.gz | |
In ipcomp6_input(), check 'md' not 'm' after a call to m_pulldown(): 'm'
may be a stale pointer at this point, and we're interested in whether or
not m_pulldown() failed.
Noticed by: Coverity Prevent analysis tool
MFC after: 3 days
Diffstat (limited to 'sys/netinet6')
| -rw-r--r-- | sys/netinet6/ipcomp_input.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/netinet6/ipcomp_input.c b/sys/netinet6/ipcomp_input.c index 1831648..be97fd1 100644 --- a/sys/netinet6/ipcomp_input.c +++ b/sys/netinet6/ipcomp_input.c @@ -258,7 +258,7 @@ ipcomp6_input(mp, offp, proto) off = *offp; md = m_pulldown(m, off, sizeof(*ipcomp), NULL); - if (!m) { + if (!md) { m = NULL; /* already freed */ ipseclog((LOG_DEBUG, "IPv6 IPComp input: assumption failed " "(pulldown failure)\n")); |
