m_freem() in tcp_respond()

[FUJITA Kazutoshi]

Hi, there.


In tcp_respond() from /sys/netinet/tcp_subr.c,
m_freem(m->m_next) is called without any checks.
I think it's better to check m->m_next is not NULL, at least.


--- /sys/netinet/tcp_subr.c.ORG Thu Jul 18 19:47:04 2002
+++ /sys/netinet/tcp_subr.c     Sun Aug 11 04:00:09 2002
@@ -393,7 +393,8 @@
                bcopy((caddr_t)th, (caddr_t)nth, sizeof(struct tcphdr));
                flags = TH_ACK;
        } else {
-               m_freem(m->m_next);
+               if (m->m_next)
+                       m_freem(m->m_next);
                m->m_next = 0;
                m->m_data = (caddr_t)ipgen;
                /* m_len is set later */


Regards,

To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-hackers" in the body of the message