From owner-svn-src-head@FreeBSD.ORG  Thu Apr  4 15:16:54 2013
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by hub.freebsd.org (Postfix) with ESMTP id 877C1AAC;
 Thu,  4 Apr 2013 15:16:54 +0000 (UTC) (envelope-from gnn@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id 79E90981;
 Thu,  4 Apr 2013 15:16:54 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.6/8.14.6) with ESMTP id r34FGspk097963;
 Thu, 4 Apr 2013 15:16:54 GMT (envelope-from gnn@svn.freebsd.org)
Received: (from gnn@localhost)
 by svn.freebsd.org (8.14.6/8.14.5/Submit) id r34FGsgo097962;
 Thu, 4 Apr 2013 15:16:54 GMT (envelope-from gnn@svn.freebsd.org)
Message-Id: <201304041516.r34FGsgo097962@svn.freebsd.org>
From: "George V. Neville-Neil" <gnn@FreeBSD.org>
Date: Thu, 4 Apr 2013 15:16:54 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r249096 - head/sys/rpc/rpcsec_gss
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 04 Apr 2013 15:16:54 -0000

Author: gnn
Date: Thu Apr  4 15:16:53 2013
New Revision: 249096
URL: http://svnweb.freebsd.org/changeset/base/249096

Log:
  Improve error handling when unwrapping received data.
  
  Submitted by:	Rick Macklem
  MFC after:	1 week

Modified:
  head/sys/rpc/rpcsec_gss/rpcsec_gss_prot.c

Modified: head/sys/rpc/rpcsec_gss/rpcsec_gss_prot.c
==============================================================================
--- head/sys/rpc/rpcsec_gss/rpcsec_gss_prot.c	Thu Apr  4 15:03:12 2013	(r249095)
+++ head/sys/rpc/rpcsec_gss/rpcsec_gss_prot.c	Thu Apr  4 15:16:53 2013	(r249096)
@@ -208,6 +208,8 @@ m_trim(struct mbuf *m, int len)
 	struct mbuf *n;
 	int off;
 
+	if (m == NULL)
+		return;
 	n = m_getptr(m, len, &off);
 	if (n) {
 		n->m_len = off;
@@ -251,10 +253,19 @@ xdr_rpc_gss_unwrap_data(struct mbuf **re
 		 * Extract the MIC and make it contiguous.
 		 */
 		cklen = get_uint32(&results);
+		if (!results) {
+			m_freem(message);
+			return (FALSE);
+		}
 		KASSERT(cklen <= MHLEN, ("unexpected large GSS-API checksum"));
 		mic = results;
-		if (cklen > mic->m_len)
+		if (cklen > mic->m_len) {
 			mic = m_pullup(mic, cklen);
+			if (!mic) {
+				m_freem(message);
+				return (FALSE);
+			}
+		}
 		if (cklen != RNDUP(cklen))
 			m_trim(mic, cklen);
 
@@ -272,6 +283,8 @@ xdr_rpc_gss_unwrap_data(struct mbuf **re
 	} else if (svc == rpc_gss_svc_privacy) {
 		/* Decode databody_priv. */
 		len = get_uint32(&results);
+		if (!results)
+			return (FALSE);
 
 		/* Decrypt databody. */
 		message = results;
@@ -294,6 +307,8 @@ xdr_rpc_gss_unwrap_data(struct mbuf **re
 
 	/* Decode rpc_gss_data_t (sequence number + arguments). */
 	seq_num = get_uint32(&message);
+	if (!message)
+		return (FALSE);
 	
 	/* Verify sequence number. */
 	if (seq_num != seq) {