Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Correctly handle the return value of arpresolve, otherwise we either leak

Browse Source 
memory or use some we already freed.

Sent on tech-net, ok christos
This commit is contained in:
maxv 2017-01-31 17:13:36 +00:00
parent b39a8cc173
commit 1880bea337
2 changed files with 13 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
sys/net/if_ecosubr.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: if_ecosubr.c,v 1.50 2017/01/24 18:37:20 maxv Exp $ */
/* $NetBSD: if_ecosubr.c,v 1.51 2017/01/31 17:13:36 maxv Exp $ */
/*-
* Copyright (c) 2001 Ben Harris
@ -58,7 +58,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: if_ecosubr.c,v 1.50 2017/01/24 18:37:20 maxv Exp $");
__KERNEL_RCSID(0, "$NetBSD: if_ecosubr.c,v 1.51 2017/01/31 17:13:36 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@ -194,12 +194,11 @@ eco_output(struct ifnet *ifp, struct mbuf *m0, const struct sockaddr *dst,
#ifdef INET
case AF_INET:
if (m->m_flags & M_BCAST)
memcpy(ehdr.eco_dhost, eco_broadcastaddr,
ECO_ADDR_LEN);
memcpy(ehdr.eco_dhost, eco_broadcastaddr, ECO_ADDR_LEN);
else if ((error = arpresolve(ifp, rt, m, dst, ehdr.eco_dhost,
sizeof(ehdr.eco_dhost))) != 0)
return error == EWOULDBLOCK ? 0 : error;
else if (!arpresolve(ifp, rt, m, dst, ehdr.eco_dhost,
sizeof(ehdr.eco_dhost)))
return (0); /* if not yet resolved */
/* If broadcasting on a simplex interface, loopback a copy */
if ((m->m_flags & M_BCAST) && (ifp->if_flags & IFF_SIMPLEX))
mcopy = m_copy(m, 0, (int)M_COPYALL);

11
sys/net/if_tokensubr.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: if_tokensubr.c,v 1.80 2017/01/24 18:37:20 maxv Exp $ */
/* $NetBSD: if_tokensubr.c,v 1.81 2017/01/31 17:13:36 maxv Exp $ */
/*
* Copyright (c) 1982, 1989, 1993
@ -92,7 +92,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: if_tokensubr.c,v 1.80 2017/01/24 18:37:20 maxv Exp $");
__KERNEL_RCSID(0, "$NetBSD: if_tokensubr.c,v 1.81 2017/01/31 17:13:36 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_inet.h"
@ -222,8 +222,11 @@ token_output(struct ifnet *ifp0, struct mbuf *m0, const struct sockaddr *dst,
*/
else {
struct llentry *la;
if (!arpresolve(ifp, rt, m, dst, edst, sizeof(edst)))
return (0); /* if not yet resolved */
error = arpresolve(ifp, rt, m, dst, edst, sizeof(edst));
if (error != 0)
return error == EWOULDBLOCK ? 0 : error;
la = rt->rt_llinfo;
KASSERT(la != NULL);
TOKEN_RIF_LLE_ASSERT(la);