[src/trunk]: src/sys/netinet6 plug memory leak on invalid fragment packet. s...

[itojun <itojun%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/f14a48eb7194
branches:  trunk
changeset: 510022:f14a48eb7194
user:      itojun <itojun%NetBSD.org@localhost>
date:      Thu May 17 14:01:37 2001 +0000

description:
plug memory leak on invalid fragment packet.  supress noisy log.  from kame

diffstat:

 sys/netinet6/frag6.c |  11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)

diffs (44 lines):

diff -r 44641e5f7056 -r f14a48eb7194 sys/netinet6/frag6.c
--- a/sys/netinet6/frag6.c      Thu May 17 13:15:47 2001 +0000
+++ b/sys/netinet6/frag6.c      Thu May 17 14:01:37 2001 +0000
@@ -1,5 +1,5 @@
-/*     $NetBSD: frag6.c,v 1.13 2001/02/22 05:04:42 itojun Exp $        */
-/*     $KAME: frag6.c,v 1.30 2001/02/22 04:52:36 itojun Exp $  */
+/*     $NetBSD: frag6.c,v 1.14 2001/05/17 14:01:37 itojun Exp $        */
+/*     $KAME: frag6.c,v 1.31 2001/05/17 13:45:34 jinmei Exp $  */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -67,6 +67,7 @@
 static void frag6_remque __P((struct ip6q *));
 static void frag6_freef __P((struct ip6q *));
 
+/* XXX we eventually need splreass6, or some real semaphore */
 int frag6_doing_reass;
 u_int frag6_nfragpackets;
 struct ip6q ip6q;      /* ip6 reassemble queue */
@@ -396,18 +397,24 @@
                i = af6->ip6af_up->ip6af_off + af6->ip6af_up->ip6af_frglen
                        - ip6af->ip6af_off;
                if (i > 0) {
+#if 0                          /* suppress the noisy log */
                        log(LOG_ERR, "%d bytes of a fragment from %s "
                            "overlaps the previous fragment\n",
                            i, ip6_sprintf(&q6->ip6q_src));
+#endif
+                       free(ip6af, M_FTABLE);
                        goto dropfrag;
                }
        }
        if (af6 != (struct ip6asfrag *)q6) {
                i = (ip6af->ip6af_off + ip6af->ip6af_frglen) - af6->ip6af_off;
                if (i > 0) {
+#if 0                          /* suppress the noisy log */
                        log(LOG_ERR, "%d bytes of a fragment from %s "
                            "overlaps the succeeding fragment",
                            i, ip6_sprintf(&q6->ip6q_src));
+#endif
+                       free(ip6af, M_FTABLE);
                        goto dropfrag;
                }
        }