From acc96c29c62035d38bea930d9f6669be56064bdd Mon Sep 17 00:00:00 2001
From: Jun-ichiro itojun Hagino <itojun@cvs.openbsd.org>
Date: Tue, 10 Feb 2004 20:20:02 +0000
Subject: plug mbuf leak (ip_fragment() always free mbuf on error).  tested by
 cedric, dhartmei ok

---
 sys/net/pf.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'sys/net/pf.c')

diff --git a/sys/net/pf.c b/sys/net/pf.c
index 4d2ab09b455..2ff09f04c04 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf.c,v 1.422 2004/02/10 18:49:10 henning Exp $ */
+/*	$OpenBSD: pf.c,v 1.423 2004/02/10 20:20:01 itojun Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -5006,8 +5006,10 @@ pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
 
 	m1 = m0;
 	error = ip_fragment(m0, ifp, ifp->if_mtu);
-	if (error)
+	if (error) {
+		m0 = NULL;
 		goto bad;
+	}
 
 	for (m0 = m1; m0; m0 = m1) {
 		m1 = m0->m_nextpkt;
-- 
cgit v1.2.3