Author: tuexen
Date: Sat Jun 26 19:26:20 2010
New Revision: 209540
URL: http://svn.freebsd.org/changeset/base/209540
Log:
* Do not dereference a NULL pointer when calling an SCTP send syscall
not providing a destination address and using ktrace.
* Do not copy out kernel memory when providing sinfo for sctp_recvmsg().
Both bug where reported by Valentin Nechayev.
The first bug results in a kernel panic.
MFC after: 3 days.
Modified:
head/sys/kern/uipc_syscalls.c
Modified: head/sys/kern/uipc_syscalls.c
==============================================================================
--- head/sys/kern/uipc_syscalls.c Sat Jun 26 18:13:44 2010
(r209539)
+++ head/sys/kern/uipc_syscalls.c Sat Jun 26 19:26:20 2010
(r209540)
@@ -2409,7 +2409,7 @@ sctp_generic_sendmsg (td, uap)
if (error)
goto sctp_bad;
#ifdef KTRACE
- if (KTRPOINT(td, KTR_STRUCT))
+ if (to && (KTRPOINT(td, KTR_STRUCT)))
ktrsockaddr(to);
#endif
@@ -2523,7 +2523,7 @@ sctp_generic_sendmsg_iov(td, uap)
if (error)
goto sctp_bad1;
#ifdef KTRACE
- if (KTRPOINT(td, KTR_STRUCT))
+ if (to && (KTRPOINT(td, KTR_STRUCT)))
ktrsockaddr(to);
#endif
@@ -2677,6 +2677,7 @@ sctp_generic_recvmsg(td, uap)
if (KTRPOINT(td, KTR_GENIO))
ktruio = cloneuio(&auio);
#endif /* KTRACE */
+ memset(&sinfo, 0, sizeof(struct sctp_sndrcvinfo));
CURVNET_SET(so->so_vnet);
error = sctp_sorecvmsg(so, &auio, (struct mbuf **)NULL,
fromsa, fromlen, &msg_flags,
_______________________________________________
svn-src-head@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
