Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix null deref, m could be NULL if M_PREPEND fails.

Browse Source
This commit is contained in:
maxv 2018-01-22 09:51:06 +00:00
parent 0689dd382b
commit 35c7659d33
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
sys/netinet/in_l2tp.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: in_l2tp.c,v 1.9 2017/12/18 03:21:44 knakahara Exp $ */
/* $NetBSD: in_l2tp.c,v 1.10 2018/01/22 09:51:06 maxv Exp $ */
/*
* Copyright (c) 2017 Internet Initiative Japan Inc.
@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: in_l2tp.c,v 1.9 2017/12/18 03:21:44 knakahara Exp $");
__KERNEL_RCSID(0, "$NetBSD: in_l2tp.c,v 1.10 2018/01/22 09:51:06 maxv Exp $");
#ifdef _KERNEL_OPT
#include "opt_l2tp.h"
@ -196,11 +196,14 @@ in_l2tp_output(struct l2tp_variant *var, struct mbuf *m)
/* prepend new IP header */
M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
if (m == NULL) {
error = ENOBUFS;
goto out;
}
if (IP_HDR_ALIGNED_P(mtod(m, void *)) == 0) {
if (m)
m = m_copyup(m, sizeof(struct ip), 0);
m = m_copyup(m, sizeof(struct ip), 0);
} else {
if (m && m->m_len < sizeof(struct ip))
if (m->m_len < sizeof(struct ip))
m = m_pullup(m, sizeof(struct ip));
}
if (m == NULL) {