Re: use after free bugs

2004-02-20 Thread Colin Percival
At 18:40 20/02/2004, John Baldwin wrote: On Thursday 19 February 2004 08:43 pm, Ted Unangst wrote: > Hi. These are some bugs found by Coverity in a static analysis run on the > FreeBSD kernel. All these are use after free bugs. Thanks for the excellent bug reports! For what it's worth, I've now

Re: use after free bugs

2004-02-20 Thread John Baldwin
On Thursday 19 February 2004 08:43 pm, Ted Unangst wrote: > Hi. These are some bugs found by Coverity in a static analysis run on the > FreeBSD kernel. All these are use after free bugs. Thanks for the excellent bug reports! -- John Baldwin <[EMAIL PROTECTED]> <>< http://www.FreeBSD.org/~jhb

Re: NULL pointer dereferences

2004-02-20 Thread Colin Percival
At 01:45 20/02/2004, Ted Unangst wrote: Some more. There are bugs where the code checks for NULL after using the pointer. Usually means the check should be earlier, or is unnecessary. One false alarm here: uni_msg_pack_mbuf(msg, ...) won't dereference msg if it is NULL. Apart from that I've ei

Re: size bugs

2004-02-20 Thread Colin Percival
At 01:48 20/02/2004, Ted Unangst wrote: A few final bugs from Coverity. Most of these are off by one, the RF bug is malloc'ing the wrong type. One false alarm here -- the first netinet6 report, since the line of code in question is never executed with bytelen==16 -- but I've got patches for thre