Date: Tue, 15 May 2018 16:54:41 +0000 (UTC) From: Stephen Hurd <shurd@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r333637 - head/sys/netinet Message-ID: <201805151654.w4FGsfEi067829@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: shurd Date: Tue May 15 16:54:41 2018 New Revision: 333637 URL: https://svnweb.freebsd.org/changeset/base/333637 Log: Check that ifma_protospec != NULL in inm_lookup If ifma_protospec is NULL when inm_lookup() is called, there is a dereference in a NULL struct pointer. This ensures that struct is not NULL before comparing the address. Reported by: dumbbell Reviewed by: sbruno Sponsored by: Limelight Networks Differential Revision: https://reviews.freebsd.org/D15440 Modified: head/sys/netinet/in_mcast.c Modified: head/sys/netinet/in_mcast.c ============================================================================== --- head/sys/netinet/in_mcast.c Tue May 15 16:44:35 2018 (r333636) +++ head/sys/netinet/in_mcast.c Tue May 15 16:54:41 2018 (r333637) @@ -344,12 +344,13 @@ inm_lookup_locked(struct ifnet *ifp, const struct in_a inm = NULL; TAILQ_FOREACH(ifma, &((ifp)->if_multiaddrs), ifma_link) { - if (ifma->ifma_addr->sa_family == AF_INET) { - inm = (struct in_multi *)ifma->ifma_protospec; - if (inm->inm_addr.s_addr == ina.s_addr) - break; - inm = NULL; - } + if (ifma->ifma_addr->sa_family != AF_INET || + ifma->ifma_protospec == NULL) + continue; + inm = (struct in_multi *)ifma->ifma_protospec; + if (inm->inm_addr.s_addr == ina.s_addr) + break; + inm = NULL; } return (inm); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201805151654.w4FGsfEi067829>