Module Name: src Committed By: maxv Date: Wed Feb 1 17:58:47 UTC 2017
Modified Files: src/sys/net: if_pppoe.c Log Message: Not sure what we are trying to achieve here, but there are two issues; error can be printed while it is not initialized, and if m_pulldown fails m is freed and reused. Quickly reviewed by christos and martin To generate a diff of this commit: cvs rdiff -u -r1.123 -r1.124 src/sys/net/if_pppoe.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/net/if_pppoe.c diff -u src/sys/net/if_pppoe.c:1.123 src/sys/net/if_pppoe.c:1.124 --- src/sys/net/if_pppoe.c:1.123 Tue Dec 27 01:31:06 2016 +++ src/sys/net/if_pppoe.c Wed Feb 1 17:58:47 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: if_pppoe.c,v 1.123 2016/12/27 01:31:06 christos Exp $ */ +/* $NetBSD: if_pppoe.c,v 1.124 2017/02/01 17:58:47 maxv Exp $ */ /*- * Copyright (c) 2002, 2008 The NetBSD Foundation, Inc. @@ -30,7 +30,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.123 2016/12/27 01:31:06 christos Exp $"); +__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.124 2017/02/01 17:58:47 maxv Exp $"); #ifdef _KERNEL_OPT #include "pppoe.h" @@ -621,19 +621,21 @@ pppoe_dispatch_disc_pkt(struct mbuf *m, case PPPOE_TAG_ACNAME: error = NULL; if (sc != NULL && len > 0) { - error = malloc(len+1, M_TEMP, M_NOWAIT); - if (error) { - n = m_pulldown(m, off + sizeof(*pt), - len, &noff); - if (n) { - strlcpy(error, - mtod(n, char*) + noff, - len); - } - printf("%s: connected to %s\n", - devname, error); + error = malloc(len + 1, M_TEMP, M_NOWAIT); + if (error == NULL) + break; + + n = m_pulldown(m, off + sizeof(*pt), len, + &noff); + if (!n) { + m = NULL; free(error, M_TEMP); + goto done; } + + strlcpy(error, mtod(n, char*) + noff, len + 1); + printf("%s: connected to %s\n", devname, error); + free(error, M_TEMP); } break; /* ignored */ case PPPOE_TAG_HUNIQUE: { @@ -704,12 +706,15 @@ pppoe_dispatch_disc_pkt(struct mbuf *m, if (err_msg) { error = NULL; if (errortag && len) { - error = malloc(len+1, M_TEMP, M_NOWAIT); + error = malloc(len + 1, M_TEMP, + M_NOWAIT|M_ZERO); n = m_pulldown(m, off + sizeof(*pt), len, &noff); - if (n && error) { - strlcpy(error, - mtod(n, char *) + noff, len); + if (!n) { + m = NULL; + } else if (error) { + strlcpy(error, mtod(n, char *) + noff, + len + 1); } } if (error) {