don't use free'd mbuf pointer; bug report net2/sys/10

SCCS-vsn: sys/kern/uipc_syscalls.c 7.26

diff --git a/usr/src/sys/kern/uipc_syscalls.c b/usr/src/sys/kern/uipc_syscalls.c
index c18e6a3..8e22cd3 100644 (file)
--- a/usr/src/sys/kern/uipc_syscalls.c
+++ b/usr/src/sys/kern/uipc_syscalls.c
@@ -2,7 +2,7 @@
  *
  * %sccs.include.redist.c%
  *
  *
  * %sccs.include.redist.c%
  *

- *     @(#)uipc_syscalls.c     7.25 (Berkeley) %G%
+ *     @(#)uipc_syscalls.c     7.26 (Berkeley) %G%

  */
 
 #include "param.h"
  */
 
 #include "param.h"


@@ -1150,6 +1150,7 @@ sockargs(mp, buf, buflen, type)
        caddr_t buf;
        int buflen, type;
 {
        caddr_t buf;
        int buflen, type;
 {

+       register struct sockaddr *sa;

        register struct mbuf *m;
        int error;
 
        register struct mbuf *m;
        int error;
 


@@ -1168,16 +1169,17 @@ sockargs(mp, buf, buflen, type)
        error = copyin(buf, mtod(m, caddr_t), (u_int)buflen);
        if (error)
                (void) m_free(m);
        error = copyin(buf, mtod(m, caddr_t), (u_int)buflen);
        if (error)
                (void) m_free(m);

-       else
+       else {

                *mp = m;
                *mp = m;

-       if (type == MT_SONAME) {
-               register struct sockaddr *sa = mtod(m, struct sockaddr *);
+               if (type == MT_SONAME) {
+                       sa = mtod(m, struct sockaddr *);

 
 #if defined(COMPAT_OLDSOCK) && BYTE_ORDER != BIG_ENDIAN
 
 #if defined(COMPAT_OLDSOCK) && BYTE_ORDER != BIG_ENDIAN

-               if (sa->sa_family == 0 && sa->sa_len < AF_MAX)
-                       sa->sa_family = sa->sa_len;
+                       if (sa->sa_family == 0 && sa->sa_len < AF_MAX)
+                               sa->sa_family = sa->sa_len;

 #endif
 #endif

-               sa->sa_len = buflen;
+                       sa->sa_len = buflen;
+               }

        }
        return (error);
 }
        }
        return (error);
 }