diff options
| author |   Eric Sesterhenn <snakebyte@gmx.de> | 2006-06-25 23:41:15 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2006-06-25 23:41:15 -0700 |
| commit | 3ac90216abc7d39e694533aec2805efeb06bf8ac (patch) | |
| tree | c3374590eb318578896b41ca5af9d098275fc36f /net/tipc/bcast.c | |
| parent | [TIPC]: Allow compilation when CONFIG_TIPC_DEBUG is not set. (diff) | |
| download | linux-dev-3ac90216abc7d39e694533aec2805efeb06bf8ac.tar.xz linux-dev-3ac90216abc7d39e694533aec2805efeb06bf8ac.zip | |
[TIPC] Fix for NULL pointer dereference
This fixes a bug spotted by the coverity checker, bug id #366. If
(mod(seqno - prev) != 1) we set buf to NULL, dereference it in the for
case, and set it to whatever value happes to be at adress 0+next, if it
happens to be non-zero, we even stay in the loop. It seems that the author
intended to break there.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Per Liden <per.liden@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/tipc/bcast.c')
| -rw-r--r-- | net/tipc/bcast.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c index 00691b7c35f8..44645f56377e 100644 --- a/net/tipc/bcast.c +++ b/net/tipc/bcast.c @@ -349,8 +349,10 @@ static void tipc_bclink_peek_nack(u32 dest, u32 sender_tag, u32 gap_after, u32 g for (; buf; buf = buf->next) { u32 seqno = buf_seqno(buf); - if (mod(seqno - prev) != 1) + if (mod(seqno - prev) != 1) { buf = NULL; + break; + } if (seqno == gap_after) break; prev = seqno; |