⬢ DragonFlyBSD Kernel Audit
DF-3483 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
diff --git a/a/sys/netgraph/netgraph/ng_base.c bb/sys/netgraph/netgraph/ng_base.c
index f9850666..e281bee9 100644
--- a/a/sys/netgraph/netgraph/ng_base.c
+++ bb/a/sys/netgraph/netgraph/ng_base.c
@@ -1262,6 +1262,7 @@ ng_generic_msg(node_p here, struct ng_mesg *msg, const char *retaddr,
 
 		if (msg->header.arglen != sizeof(*mkp)) {
 			TRAP_ERROR;
+			kfree(msg, M_NETGRAPH);
 			return (EINVAL);
 		}
 		mkp->type[sizeof(mkp->type) - 1] = '\0';
@@ -1278,6 +1279,7 @@ ng_generic_msg(node_p here, struct ng_mesg *msg, const char *retaddr,
 
 		if (msg->header.arglen != sizeof(*con)) {
 			TRAP_ERROR;
+			kfree(msg, M_NETGRAPH);
 			return (EINVAL);
 		}
 		con->path[sizeof(con->path) - 1] = '\0';
@@ -1295,6 +1297,7 @@ ng_generic_msg(node_p here, struct ng_mesg *msg, const char *retaddr,
 
 		if (msg->header.arglen != sizeof(*nam)) {
 			TRAP_ERROR;
+			kfree(msg, M_NETGRAPH);
 			return (EINVAL);
 		}
 		nam->name[sizeof(nam->name) - 1] = '\0';
@@ -1308,6 +1311,7 @@ ng_generic_msg(node_p here, struct ng_mesg *msg, const char *retaddr,
 
 		if (msg->header.arglen != sizeof(*rmh)) {
 			TRAP_ERROR;
+			kfree(msg, M_NETGRAPH);
 			return (EINVAL);
 		}
 		rmh->ourhook[sizeof(rmh->ourhook) - 1] = '\0';