Date: Sat, 8 Sep 2001 22:20:36 +0200 (CEST) From: Christian Carstensen <cc@devcon.net> To: FreeBSD-gnats-submit@freebsd.org Subject: kern/30440: possible null pointer deref in bpfdetach() Message-ID: <200109082020.f88KKak01433@gatekeeper.gate5.de>
next in thread | raw e-mail | index | archive | help
>Number: 30440
>Category: kern
>Synopsis: possible null pointer deref in bpfdetach()
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat Sep 08 13:30:01 PDT 2001
>Closed-Date:
>Last-Modified:
>Originator: Christian Carstensen
>Release: FreeBSD 5.0-CURRENT i386
>Organization:
>Environment:
System: FreeBSD albert.gate5.de 5.0-CURRENT FreeBSD 5.0-CURRENT #25: Thu Sep 6 04:20:50 CEST 2001 root@albert.gate5.de:/usr/src/sys/i386/compile/ALBERT i386
>Description:
in net/bpf.c, bpfdetach(), stuct bpf_if *bp is used in a for loop, that,
if not terminated by break before, leaves bp == NULL.
evaluating (bp->bif_ifp == NULL) two lines later will cause a NULL pointer
dereference, resulting in trap 12.
>How-To-Repeat:
just call bpfdetach(ifp) with any ifp that has no bpf interface attached.
>Fix:
RCS file: /usr/cvs/src/sys/net/bpf.c,v
retrieving revision 1.80
diff -r1.80 bpf.c
1267c1267
< if (bp->bif_ifp == NULL) {
---
> if (bp == NULL || bp->bif_ifp == NULL) {
>Release-Note:
>Audit-Trail:
>Unformatted:
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200109082020.f88KKak01433>