do not follow m == NULL when packet is too short and pullup is failed.

found in interim meeting network
kame · Sep 29, 1999 · 64d0efa · 64d0efa
1 parent b05dc44
commit 64d0efa
Showing 1 changed file with 8 additions and 5 deletions.
diff --git a/kame/sys/netinet6/ip6_input.c b/kame/sys/netinet6/ip6_input.c
@@ -326,11 +326,14 @@ ip6_input(m)
 
 	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), /*nothing*/);
 
-	if (m->m_len < sizeof(struct ip6_hdr) &&
-	    (m = m_pullup(m, sizeof(struct ip6_hdr))) == 0) {
-		ip6stat.ip6s_toosmall++;
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
-		return;
+	if (m->m_len < sizeof(struct ip6_hdr)) {
+		struct ifnet *inifp;
+		inifp = m->m_pkthdr.rcvif;
+		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == 0) {
+			ip6stat.ip6s_toosmall++;
+			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
+			return;
+		}
 	}
 
 	ip6 = mtod(m, struct ip6_hdr *);