Author: syrinx
Date: Mon Sep 7 16:00:33 2009
New Revision: 196932
URL: http://svn.freebsd.org/changeset/base/196932
Log:
When joining a multicast group, the inp_lookup_mcast_ifp call
does a KASSERT that the group address is multicast, so the
check if this is indeed true and eventually return a EINVAL if not,
should be done before calling inp_lookup_mcast_ifp. This fixes a kernel
crash when calling setsockopt (sock, IPPROTO_IP, IP_ADD_MEMBERSHIP,...)
with invalid group address.
Reviewed by: bms
Approved by: bms
MFC after: 3 days
Modified:
head/sys/netinet/in_mcast.c
Modified: head/sys/netinet/in_mcast.c
==============================================================================
--- head/sys/netinet/in_mcast.c Mon Sep 7 15:52:15 2009 (r196931)
+++ head/sys/netinet/in_mcast.c Mon Sep 7 16:00:33 2009 (r196932)
@@ -1899,6 +1899,9 @@ inp_join_group(struct inpcb *inp, struct
ssa->sin.sin_addr = mreqs.imr_sourceaddr;
}
+ if (!IN_MULTICAST(ntohl(gsa->sin.sin_addr.s_addr)))
+ return (EINVAL);
+
ifp = inp_lookup_mcast_ifp(inp, &gsa->sin,
mreqs.imr_interface);
CTR3(KTR_IGMPV3, "%s: imr_interface = %s, ifp = %p",
@@ -1936,6 +1939,9 @@ inp_join_group(struct inpcb *inp, struct
ssa->sin.sin_port = 0;
}
+ if (!IN_MULTICAST(ntohl(gsa->sin.sin_addr.s_addr)))
+ return (EINVAL);
+
if (gsr.gsr_interface == 0 || V_if_index < gsr.gsr_interface)
return (EADDRNOTAVAIL);
ifp = ifnet_byindex(gsr.gsr_interface);
@@ -1948,9 +1954,6 @@ inp_join_group(struct inpcb *inp, struct
break;
}
- if (!IN_MULTICAST(ntohl(gsa->sin.sin_addr.s_addr)))
- return (EINVAL);
-
if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0)
return (EADDRNOTAVAIL);
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
