projects / dragonfly.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a45d814) | patch
Fix two serious bugs in the IP demux code. First, if ip_mport() m_pullup()'s
authorMatthew Dillon <dillon@dragonflybsd.org>
Sun, 18 Jul 2004 16:26:43 +0000 (16:26 +0000)
committerMatthew Dillon <dillon@dragonflybsd.org>
Sun, 18 Jul 2004 16:26:43 +0000 (16:26 +0000)
commitb01ae44a0a8c0489aab069e00c511d15f619edb1
tree0e4ed92b0ec024172dc437c64b01b4b0fbb8837atree | snapshot
parenta45d814644137db649e49effac48306f087d0481commit | diff
Fix two serious bugs in the IP demux code.  First, if ip_mport() m_pullup()'s
an mbuf, the new/modified mbuf is not returned to the caller and the caller
may wind up using a stale/freed mbuf.  Second, ip_mport() was not consistently
freeding mbufs which could lead to both a memory leak and a double free.

Reported-by: YONETANI Tomokazu <qhwt+dragonfly-bugs@les.ath.cx> (panic: TCP header not in one mbuf).
sys/net/netisr.c diff | blob | blame | history
sys/net/netisr.h diff | blob | blame | history
sys/netinet/ip_demux.c diff | blob | blame | history
sys/netinet/ip_input.c diff | blob | blame | history
sys/netinet/ip_var.h diff | blob | blame | history
DragonFly Project Source