christos dae3cea673 Fix use after free on packet with broken lengths ... Under the scenario with a packet with length of 67 bytes, a header length using the default of 20 bytes and a TCP data offset (th_off) of 48 will cause m_pullup() to fail to make sure bytes are arranged contiguously. m_pullup() will free the mbuf chain and return a null. ipfilter stores the resultant mbuf address (or the resulting NULL) in its fr_info_t structure. Unfortunately the erroneous packet is not flagged for drop. From FreeBSD via CY Schubert; originally reported by: Robert Morris <rtm at lcs.mit.edu>		2023-02-03 19:01:08 +00:00
..
bsd	Fix use after free on packet with broken lengths	2023-02-03 19:01:08 +00:00
gpl2/dts	Import dts from Linux 5.15	2021-11-13 08:40:13 +00:00
isc	don't opencode kauth_cred_get()	2021-09-21 14:49:01 +00:00
mit/xen-include-public/dist/xen/include/public	…