diff options
| author | sam <sam@FreeBSD.org> | 2005-03-28 18:51:58 +0000 |
|---|---|---|
| committer | sam <sam@FreeBSD.org> | 2005-03-28 18:51:58 +0000 |
| commit | 98cd0f3cc2bc0fd4a73cf579768f3e7f8eb0fc59 (patch) | |
| tree | 9f378a0a1528b91e2f2f9d4abee8e5ae5e20daf5 /sys/nfsserver | |
| parent | e5a103489f7b517da7e896b169b04b5861a3e589 (diff) | |
| download | FreeBSD-src-98cd0f3cc2bc0fd4a73cf579768f3e7f8eb0fc59.zip FreeBSD-src-98cd0f3cc2bc0fd4a73cf579768f3e7f8eb0fc59.tar.gz | |
avoid potential null ptr deref by free'ing excess mbufs instead of
zero'ing their length (copied from m_adj where this code came from
after the equivalent change there has had time to soak)
Noticed by: Coverity Prevent analysis tool
Diffstat (limited to 'sys/nfsserver')
| -rw-r--r-- | sys/nfsserver/nfs_srvsubs.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/sys/nfsserver/nfs_srvsubs.c b/sys/nfsserver/nfs_srvsubs.c index 7746efc..912b5a7 100644 --- a/sys/nfsserver/nfs_srvsubs.c +++ b/sys/nfsserver/nfs_srvsubs.c @@ -949,12 +949,14 @@ nfsm_adj(struct mbuf *mp, int len, int nul) for (i = 0; i < nul; i++) *cp++ = '\0'; } + if (m->m_next != NULL) { + m_freem(m->m_next); + m->m_next = NULL; + } break; } count -= m->m_len; } - for (m = m->m_next;m;m = m->m_next) - m->m_len = 0; } /* |
