From a08da7cd98bf2aff1c327d1becbb7614c27a40b4 Mon Sep 17 00:00:00 2001 From: andre Date: Wed, 18 Jan 2006 14:24:39 +0000 Subject: Return mbuf pointer or NULL from ip_fastforward() as the mbuf pointer may have changed by m_pullup() during fastforward processing. While this is a bug it is actually never triggered in real world situations and it is not remotely exploitable. Found by: Coverity Prevent(tm) Coverity ID: CID780 Sponsored by: TCP/IP Optimization Fundraise 2005 --- sys/net/if_arcsubr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sys/net/if_arcsubr.c') diff --git a/sys/net/if_arcsubr.c b/sys/net/if_arcsubr.c index 6cdb951..f3c00cd 100644 --- a/sys/net/if_arcsubr.c +++ b/sys/net/if_arcsubr.c @@ -559,14 +559,14 @@ arc_input(ifp, m) #ifdef INET case ARCTYPE_IP: m_adj(m, ARC_HDRNEWLEN); - if (ip_fastforward(m)) + if ((m = ip_fastforward(m)) == NULL) return; isr = NETISR_IP; break; case ARCTYPE_IP_OLD: m_adj(m, ARC_HDRLEN); - if (ip_fastforward(m)) + if ((m = ip_fastforward(m)) == NULL) return; isr = NETISR_IP; break; -- cgit v1.1