CVSROOT: /cvs
Module name: src
Changes by: bl...@cvs.openbsd.org 2017/05/04 11:58:46
Modified files:
sys/net : if_etherip.c
sys/netinet : igmp.c ip_carp.c ip_gre.c ip_icmp.c ip_ipip.c
tcp_input.c udp_usrreq.c
sys/netinet6 : icmp6.c
Log message:
If m is not a continuous mbuf cluster, m_pullup() in pr_input may
change the pointer. Then *mp keeps the invalid pointer and it might
be used. Fix the potential use after free and also reset *mp in
other places to have less dangling pointers to freed mbufs.
OK mpi@ mikeb@
