Date: Fri, 08 Jan 2021 08:30:10 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 252504] IGMP_V3 packet with malformed number of sources is discarded but mbuf not freed Message-ID: <bug-252504-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D252504 Bug ID: 252504 Summary: IGMP_V3 packet with malformed number of sources is discarded but mbuf not freed Product: Base System Version: Unspecified Hardware: Any OS: Any Status: New Severity: Affects Many People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: panagiotis.tsolakos@gmail.com In igmp.c, in function igmp_input(), the correctness of the incoming igmp packet is checked. If the packet is discarded because of wrong number of sources the mbuf is not freed. /* * Validate length based on source count. */ nsrc =3D ntohs(igmpv3->igmp_numsrc); if (nsrc * sizeof(in_addr_t) > UINT16_MAX - iphlen - IGMP_V3_QUERY_MINLEN) { IGMPSTAT_INC(igps_rcv_tooshort); return (IPPROTO_DONE); } The mbuf should be freed before the function returns: /* * Validate length based on source count. */ nsrc =3D ntohs(igmpv3->igmp_numsrc); if (nsrc * sizeof(in_addr_t) > UINT16_MAX - iphlen - IGMP_V3_QUERY_MINLEN) { IGMPSTAT_INC(igps_rcv_tooshort); + m_freem(m); return (IPPROTO_DONE); } --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-252504-227>