Author: shurd Date: Tue May 15 16:54:41 2018 New Revision: 333637 URL: https://svnweb.freebsd.org/changeset/base/333637
Log: Check that ifma_protospec != NULL in inm_lookup If ifma_protospec is NULL when inm_lookup() is called, there is a dereference in a NULL struct pointer. This ensures that struct is not NULL before comparing the address. Reported by: dumbbell Reviewed by: sbruno Sponsored by: Limelight Networks Differential Revision: https://reviews.freebsd.org/D15440 Modified: head/sys/netinet/in_mcast.c Modified: head/sys/netinet/in_mcast.c ============================================================================== --- head/sys/netinet/in_mcast.c Tue May 15 16:44:35 2018 (r333636) +++ head/sys/netinet/in_mcast.c Tue May 15 16:54:41 2018 (r333637) @@ -344,12 +344,13 @@ inm_lookup_locked(struct ifnet *ifp, const struct in_a inm = NULL; TAILQ_FOREACH(ifma, &((ifp)->if_multiaddrs), ifma_link) { - if (ifma->ifma_addr->sa_family == AF_INET) { - inm = (struct in_multi *)ifma->ifma_protospec; - if (inm->inm_addr.s_addr == ina.s_addr) - break; - inm = NULL; - } + if (ifma->ifma_addr->sa_family != AF_INET || + ifma->ifma_protospec == NULL) + continue; + inm = (struct in_multi *)ifma->ifma_protospec; + if (inm->inm_addr.s_addr == ina.s_addr) + break; + inm = NULL; } return (inm); } _______________________________________________ svn-src-head@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
