Missing NULL-node guard in ng_gif_input/ng_gif_input_orphan (latent panic; unreachable while file is dead code)
Summary
DEAD CODE: file cannot compile (IFP2NG/IFP2NG_SET access gif_softc.gif_netgraph field that doesnt exist in struct gif_softc if_gif.h:50-63; ng_gif_mod_event references ng_gif_*_p hooks never declared/defined; sys/conf/files:1706 gates behind options netgraph7_gif enabled by no kernel config). ng_gif_input :170-173 and ng_gif_input_orphan :190-191 dereference NG_NODE_PRIVATE(IFP2NG(ifp)) with no NULL guard. ng_gif_detach :272 correctly guards if(node==NULL)return but input hooks dont. If gif interface has no attached ng_gif node (common case) NULL-deref panic. Doubly unreachable: file doesnt build + if_gif.c never calls these _p hooks. Info/speculative: real crash bug if build revived. Fix: add if(node==NULL) return/m_freem guard.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0678 Β· 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| manifest.json | file | 392 B | view raw |
Fix verification
not_testablerecommended fix identified; fix.diff not authored/validated in this batch
recommended fix identified; fix.diff not authored/validated in this batch
Confirmed kernel references
β
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/netgraph7/ng_gif.c:170: missing NULL-node guard (latent panic; file is dead code)
Verified recommended fix
Source-confirmed at sys/netgraph7/ng_gif.c:170: missing NULL-node guard (latent panic; file is dead code)
Verdict
Source-confirmed at sys/netgraph7/ng_gif.c:170: missing NULL-node guard (latent panic; file is dead code)
No comments yet.