mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-06 09:10:28 +00:00
Add a check for a NULL mbuf ptr at the beginning of xdrmbuf_inline()
so that it returns failure instead of crashing when "m->m_len" is executed and m == NULL. The mbuf ptr can be NULL when a call to xdrmbuf_getbytes() gets the bytes it needs, but they are at the end of a short RPC reply. When this happens, xdrmbuf_getbytes() returns success, but advances the mbuf ptr (xdrs->x_private) to m_next, which is NULL. If this is followed by a call to xdrmbuf_getlong(), it calls xdrmbuf_inline(), which would cause a crash by accessing "m->m_len". Tested by: pho, serenity at exscape dot org Approved by: re (rwatson), kib (mentor)
This commit is contained in:
parent
8b28fd0239
commit
0990c0a12c
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=196149
|
@ -282,6 +282,8 @@ xdrmbuf_inline(XDR *xdrs, u_int len)
|
|||
size_t available;
|
||||
char *p;
|
||||
|
||||
if (!m)
|
||||
return (0);
|
||||
if (xdrs->x_op == XDR_ENCODE) {
|
||||
available = M_TRAILINGSPACE(m) + (m->m_len - xdrs->x_handy);
|
||||
} else {
|
||||
|
|
Loading…
Reference in a new issue