From becc212fd34eb2fe45097dd6e04187cfd3666a0b Mon Sep 17 00:00:00 2001 From: andre Date: Sat, 6 Nov 2004 10:47:36 +0000 Subject: Fix a double-free in the 'm->m_len < sizeof (struct ip)' sanity check. Bug report by: MFC after: 2 weeks --- sys/netinet/ip_fastfwd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sys/netinet') diff --git a/sys/netinet/ip_fastfwd.c b/sys/netinet/ip_fastfwd.c index 1ad7d45..f0add29 100644 --- a/sys/netinet/ip_fastfwd.c +++ b/sys/netinet/ip_fastfwd.c @@ -195,9 +195,9 @@ ip_fastforward(struct mbuf *m) * Is first mbuf large enough for ip header and is header present? */ if (m->m_len < sizeof (struct ip) && - (m = m_pullup(m, sizeof (struct ip))) == 0) { + (m = m_pullup(m, sizeof (struct ip))) == NULL) { ipstat.ips_toosmall++; - goto drop; + return 1; /* mbuf already free'd */ } ip = mtod(m, struct ip *); -- cgit v1.1