diff options
| author |   bluhm <bluhm@openbsd.org> | 2017-09-15 19:29:28 +0000 |
|---|---|---|
| committer | bluhm <bluhm@openbsd.org> | 2017-09-15 19:29:28 +0000 |
| commit | bd42128be7e8eb50ae3846fd30af7dbb541ddc27 (patch) | |
| tree | 023cf2542e7eeac1afe16287eedac95747ca1021 /sys/kern/uipc_socket.c | |
| parent | Coverity complained that the while loop at the end of m_adj() could (diff) | |
| download | wireguard-openbsd-bd42128be7e8eb50ae3846fd30af7dbb541ddc27.tar.xz wireguard-openbsd-bd42128be7e8eb50ae3846fd30af7dbb541ddc27.zip | |
Coverity complains that top == NULL was checked and further down
top->m_pkthdr.len was accessed without check. See CID 1452933.
In fact top cannot be NULL there and the condition was always false.
m_getuio() did never reserve space for the header. The correct
check is m == top to find the first mbuf.
OK visa@
Diffstat (limited to 'sys/kern/uipc_socket.c')
| -rw-r--r-- | sys/kern/uipc_socket.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 1e5fa38b345..615da029414 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uipc_socket.c,v 1.204 2017/09/11 11:15:52 bluhm Exp $ */ +/* $OpenBSD: uipc_socket.c,v 1.205 2017/09/15 19:29:28 bluhm Exp $ */ /* $NetBSD: uipc_socket.c,v 1.21 1996/02/04 02:17:52 christos Exp $ */ /* @@ -540,7 +540,7 @@ m_getuio(struct mbuf **mp, int atomic, long space, struct uio *uio) * For datagram protocols, leave room * for protocol headers in first mbuf. */ - if (atomic && top == NULL && len < mlen - max_hdr) + if (atomic && m == top && len < mlen - max_hdr) m->m_data += max_hdr; } else { nopages: @@ -549,7 +549,7 @@ nopages: * For datagram protocols, leave room * for protocol headers in first mbuf. */ - if (atomic && top == NULL && len < mlen - max_hdr) + if (atomic && m == top && len < mlen - max_hdr) MH_ALIGN(m, len); } |