⬢ DragonFlyBSD Kernel Audit
DF-3552 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
--- a/sys/netgraph/ng_sample.c	2026-09-14 20:30:13.466637150 +0000
+++ b/sys/netgraph/ng_sample.c	2026-09-14 20:30:22.606521885 +0000
@@ -207,7 +207,7 @@
 	    NG_XXX_HOOK_DLCI_LEADIN, strlen(NG_XXX_HOOK_DLCI_LEADIN)) == 0) {
 		char *eptr;
 
-		cp = name + sizeof(NG_XXX_HOOK_DLCI_LEADIN);
+		cp = name + strlen(NG_XXX_HOOK_DLCI_LEADIN);
 		if (!isdigit(*cp) || (cp[0] == '0' && cp[1] != '\0'))
 			return (EINVAL);
 		dlci = (int)strtoul(cp, &eptr, 10);
@@ -220,13 +220,14 @@
 				break;
 		if (chan == XXX_NUM_DLCIS) {
 			for (chan = 0; chan < XXX_NUM_DLCIS; chan++)
-				if (xxxp->channel[chan].dlci != -2)
-					continue;
+				if (xxxp->channel[chan].dlci == -2)
+					break;
 			if (chan == XXX_NUM_DLCIS)
 				return (ENOBUFS);
 		}
 		if (xxxp->channel[chan].hook != NULL)
 			return (EADDRINUSE);
+		xxxp->channel[chan].dlci = dlci;
 		hook->private = xxxp->channel + chan;
 		xxxp->channel[chan].hook = hook;
 		return (0);
@@ -459,8 +460,12 @@
 static int
 ng_xxx_disconnect(hook_p hook)
 {
+	const xxx_p xxxp = hook->node->private;
+
 	if (hook->private)
 		((struct XXX_hookinfo *) (hook->private))->hook = NULL;
+	if (xxxp != NULL && xxxp->debughook == hook)
+		xxxp->debughook = NULL;
 	if (hook->node->numhooks == 0)
 		ng_rmnode(hook->node);
 	return (0);