Date: Mon, 17 Nov 2008 07:09:40 +0000 (UTC) From: Philip Paeps <philip@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r185021 - head/sys/dev/glxsb Message-ID: <200811170709.mAH79ecr075977@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: philip Date: Mon Nov 17 07:09:40 2008 New Revision: 185021 URL: http://svn.freebsd.org/changeset/base/185021 Log: Fix two possible (but unlikely) NULL-pointer dereferences in glxsb(4). Spotted by: Coverity MFC after: 1 week Modified: head/sys/dev/glxsb/glxsb.c Modified: head/sys/dev/glxsb/glxsb.c ============================================================================== --- head/sys/dev/glxsb/glxsb.c Mon Nov 17 07:03:05 2008 (r185020) +++ head/sys/dev/glxsb/glxsb.c Mon Nov 17 07:09:40 2008 (r185021) @@ -358,7 +358,8 @@ glxsb_detach(device_t dev) return (EBUSY); } } - while ((ses = TAILQ_FIRST(&sc->sc_sessions)) != NULL) { + while (!TAILQ_EMPTY(&sc->sc_sessions)) { + ses = TAILQ_FIRST(&sc->sc_sessions); TAILQ_REMOVE(&sc->sc_sessions, ses, ses_next); free(ses, M_GLXSB); } @@ -867,8 +868,11 @@ glxsb_crypto_process(device_t dev, struc enccrd = maccrd = NULL; - if (crp == NULL || - crp->crp_callback == NULL || crp->crp_desc == NULL) { + /* Sanity check. */ + if (crp == NULL) + return (EINVAL); + + if (crp->crp_callback == NULL || crp->crp_desc == NULL) { error = EINVAL; goto fail; }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200811170709.mAH79ecr075977>