Skip to content

Commit

Permalink
[SQUASH ME] ng_icmpv6: prevent buffer leaking
Browse files Browse the repository at this point in the history
  • Loading branch information
miri64 committed Mar 20, 2015
1 parent 6e1ca1d commit ce1af46
Showing 1 changed file with 13 additions and 1 deletion.
14 changes: 13 additions & 1 deletion sys/net/network_layer/ng_icmpv6/ng_icmpv6.c
Original file line number Diff line number Diff line change
Expand Up @@ -69,11 +69,13 @@ void ng_icmpv6_demux(ng_pktsnip_t *pkt)
{
ng_pktsnip_t *icmpv6, *ipv6;
ng_icmpv6_hdr_t *hdr;
size_t receiver_num = 0;

LL_SEARCH_SCALAR(pkt, icmpv6, type, NG_NETTYPE_ICMPV6);

if (icmpv6 == NULL) {
DEBUG("icmpv6: received packet has no payload\n");
/* don't release: IPv6 does this */
return;
}

Expand All @@ -83,13 +85,15 @@ void ng_icmpv6_demux(ng_pktsnip_t *pkt)

if (ipv6 == NULL) {
DEBUG("ipv6: received packet has no IPv6 header\n");
/* don't release: IPv6 does this */
return;
}

hdr = (ng_icmpv6_hdr_t *)icmpv6->data;

if (_icmpv6_inet_csum((ng_ipv6_hdr_t *)(ipv6->data), hdr, icmpv6->size) != 0xffff) {
DEBUG("icmpv6: wrong checksum.\n");
/* don't release: IPv6 does this */
return;
}

Expand Down Expand Up @@ -127,7 +131,15 @@ void ng_icmpv6_demux(ng_pktsnip_t *pkt)
/* ICMPv6-all will be send send in ng_ipv6.c so only dispatch of
* subtypes is needed */

ng_pktbuf_hold(pkt, ng_netreg_num(NG_NETTYPE_ICMPV6, hdr->type) - 1);
receiver_num = ng_netreg_num(NG_NETTYPE_ICMPV6, hdr->type);

if (receiver_num == 0) {
DEBUG("icmpv6: no receivers for ICMPv6 type %" PRIu8 "\n", hdr->type);
/* don't release: IPv6 does this */
return;
}

ng_pktbuf_hold(pkt, receiver_num - 1);
/* ICMPv6 is not interested anymore so `- 1` */
_dispatch_received(NG_NETTYPE_ICMPV6, hdr->type, pkt);
}
Expand Down

0 comments on commit ce1af46

Please sign in to comment.