Module Name: src
Committed By: maxv
Date: Wed Jan 24 13:54:16 UTC 2018
Modified Files:
src/sys/netipsec: xform_esp.c
Log Message:
Add missing NULL check. Normally that's not triggerable remotely, since we
are guaranteed that 8 bytes are valid at mbuf+skip.
To generate a diff of this commit:
cvs rdiff -u -r1.72 -r1.73 src/sys/netipsec/xform_esp.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/netipsec/xform_esp.c
diff -u src/sys/netipsec/xform_esp.c:1.72 src/sys/netipsec/xform_esp.c:1.73
--- src/sys/netipsec/xform_esp.c:1.72 Tue Oct 3 08:56:52 2017
+++ src/sys/netipsec/xform_esp.c Wed Jan 24 13:54:16 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: xform_esp.c,v 1.72 2017/10/03 08:56:52 ozaki-r Exp $ */
+/* $NetBSD: xform_esp.c,v 1.73 2018/01/24 13:54:16 maxv Exp $ */
/* $FreeBSD: src/sys/netipsec/xform_esp.c,v 1.2.2.1 2003/01/24 05:11:36 sam Exp $ */
/* $OpenBSD: ip_esp.c,v 1.69 2001/06/26 06:18:59 angelos Exp $ */
@@ -39,7 +39,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.72 2017/10/03 08:56:52 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.73 2018/01/24 13:54:16 maxv Exp $");
#if defined(_KERNEL_OPT)
#include "opt_inet.h"
@@ -322,6 +322,10 @@ esp_input(struct mbuf *m, struct secasva
/* XXX don't pullup, just copy header */
IP6_EXTHDR_GET(esp, struct newesp *, m, skip, sizeof(struct newesp));
+ if (esp == NULL) {
+ /* m already freed */
+ return EINVAL;
+ }
esph = sav->tdb_authalgxform;
espx = sav->tdb_encalgxform;
