Aren/NetBSD
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix pullup'ed mbuf leaks. pointed out by maxv@n.o, thanks.

Browse Source 
XXX need pullup-8
This commit is contained in:
knakahara 2017-12-11 02:17:35 +00:00
parent bd05c4c470
commit e56a093de8
2 changed files with 10 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/netinet/in_l2tp.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: in_l2tp.c,v 1.4 2017/11/15 10:42:41 knakahara Exp $ */
/* $NetBSD: in_l2tp.c,v 1.5 2017/12/11 02:17:35 knakahara Exp $ */
/*
* Copyright (c) 2017 Internet Initiative Japan Inc.
@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: in_l2tp.c,v 1.4 2017/11/15 10:42:41 knakahara Exp $");
__KERNEL_RCSID(0, "$NetBSD: in_l2tp.c,v 1.5 2017/12/11 02:17:35 knakahara Exp $");
#ifdef _KERNEL_OPT
#include "opt_l2tp.h"
@ -368,13 +368,9 @@ in_l2tp_match(struct mbuf *m, int off, int proto, void *arg)
KASSERT(proto == IPPROTO_L2TP);
if (m->m_len < off + sizeof(uint32_t)) {
m = m_pullup(m, off + sizeof(uint32_t));
if (!m) {
/* if payload length < 4 octets */
return 0;
}
}
/* if payload length < 4 octets */
if (m->m_len < off + sizeof(uint32_t))
return 0;
/* get L2TP session ID */
m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id);

14
sys/netinet6/in6_l2tp.c
View File

@ -1,4 +1,4 @@
/* $NetBSD: in6_l2tp.c,v 1.7 2017/11/15 10:42:41 knakahara Exp $ */
/* $NetBSD: in6_l2tp.c,v 1.8 2017/12/11 02:17:35 knakahara Exp $ */
/*
* Copyright (c) 2017 Internet Initiative Japan Inc.
@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: in6_l2tp.c,v 1.7 2017/11/15 10:42:41 knakahara Exp $");
__KERNEL_RCSID(0, "$NetBSD: in6_l2tp.c,v 1.8 2017/12/11 02:17:35 knakahara Exp $");
#ifdef _KERNEL_OPT
#include "opt_l2tp.h"
@ -360,13 +360,9 @@ in6_l2tp_match(struct mbuf *m, int off, int proto, void *arg)
KASSERT(proto == IPPROTO_L2TP);
if (m->m_len < off + sizeof(uint32_t)) {
m = m_pullup(m, off + sizeof(uint32_t));
if (!m) {
/* if payload length < 4 octets */
return 0;
}
}
/* if payload length < 4 octets */
if (m->m_len < off + sizeof(uint32_t))
return 0;
/* get L2TP session ID */
m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id);