diff options
| author | Kenneth R Westerback <krw@cvs.openbsd.org> | 2020-06-22 11:30:24 +0000 |
|---|---|---|
| committer | Kenneth R Westerback <krw@cvs.openbsd.org> | 2020-06-22 11:30:24 +0000 |
| commit | 98c6cb2957bf7478df2b82ec60e7a314a030d145 (patch) | |
| tree | 51b1d034108b48e0d1705f2ad7dfe5feb468e4b4 /sys/netinet6 | |
| parent | c0ff2f6a40ff4a540e07a8278d8ee2c8a511d62a (diff) | |
Don't pass a pointer to an uninitialized variable as plenp to
ip6_hopopts(). The value is tested and non-zero values could cause a
packet to be discarded.
Initialize the pointed at variable to 0, tweaking variable names and
associated comments.
COVERITY 1453098
ok deraadt@ mpi@
Diffstat (limited to 'sys/netinet6')
| -rw-r--r-- | sys/netinet6/ip6_output.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index 219080d5c7a..a4c5c816e54 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ip6_output.c,v 1.245 2019/11/29 16:41:01 nayden Exp $ */ +/* $OpenBSD: ip6_output.c,v 1.246 2020/06/22 11:30:23 krw Exp $ */ /* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */ /* @@ -600,13 +600,13 @@ reroute: */ if (exthdrs.ip6e_hbh) { struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *); - u_int32_t dummy1; /* XXX unused */ - u_int32_t dummy2; /* XXX unused */ + u_int32_t rtalert; /* returned value is ignored */ + u_int32_t plen = 0; /* no more than 1 jumbo payload option! */ m->m_pkthdr.ph_ifidx = ifp->if_index; if (ip6_process_hopopts(m, (u_int8_t *)(hbh + 1), ((hbh->ip6h_len + 1) << 3) - sizeof(struct ip6_hbh), - &dummy1, &dummy2) < 0) { + &rtalert, &plen) < 0) { /* m was already freed at this point */ error = EINVAL;/* better error? */ goto done; |