DragonFlyBSD Kernel Audit
DF-0673 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/netproto/smb/smb_trantcp.c b/sys/netproto/smb/smb_trantcp.c
--- a/sys/netproto/smb/smb_trantcp.c
+++ b/sys/netproto/smb/smb_trantcp.c
@@ -334,6 +334,10 @@
 			nbp->nbp_state = NBST_CLOSED;
 			NBDEBUG("session closed by peer\n");
 			error = ECONNRESET;
+			if (sio.sb_mb != NULL) {
+				m_freem(sio.sb_mb);
+				sio.sb_mb = NULL;
+			}
 			break;
 		}
 		if (error)
@@ -343,14 +347,21 @@
 		if (rpcode == NB_SSN_KEEPALIVE)
 			continue;
 		do {
+			if (sio.sb_mb != NULL)
+				m_freem(sio.sb_mb);
 			sbinit(&sio, savelen);
 			rcvflg = MSG_WAITALL;
 			error = so_pru_soreceive(so, NULL, NULL, &sio,
 						 NULL, &rcvflg);
 		} while (error == EWOULDBLOCK || error == EINTR ||
 				 error == ERESTART);
-		if (error)
+		if (error) {
+			if (sio.sb_mb != NULL) {
+				m_freem(sio.sb_mb);
+				sio.sb_mb = NULL;
+			}
 			break;
+		}
 		if (sio.sb_cc != savelen) {
 			SMBERROR("packet is shorter than expected\n");
 			error = EPIPE;