https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=252504
Bug ID: 252504
Summary: IGMP_V3 packet with malformed number of sources is
discarded but mbuf not freed
Product: Base System
Version: Unspecified
Hardware: Any
OS: Any
Status: New
Severity: Affects Many People
Priority: ---
Component: kern
Assignee: b...@freebsd.org
Reporter: panagiotis.tsola...@gmail.com
In igmp.c, in function igmp_input(), the correctness of the incoming igmp
packet is checked. If the packet is discarded because of wrong number of
sources the mbuf is not freed.
/*
* Validate length based on source count.
*/
nsrc = ntohs(igmpv3->igmp_numsrc);
if (nsrc * sizeof(in_addr_t) >
UINT16_MAX - iphlen - IGMP_V3_QUERY_MINLEN) {
IGMPSTAT_INC(igps_rcv_tooshort);
return (IPPROTO_DONE);
}
The mbuf should be freed before the function returns:
/*
* Validate length based on source count.
*/
nsrc = ntohs(igmpv3->igmp_numsrc);
if (nsrc * sizeof(in_addr_t) >
UINT16_MAX - iphlen - IGMP_V3_QUERY_MINLEN) {
IGMPSTAT_INC(igps_rcv_tooshort);
+ m_freem(m);
return (IPPROTO_DONE);
}
--
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-bugs@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
