misc/172599: Null function pointer in ipfilter
Erik Cederstrand
erik at cederstrand.dk
Thu Oct 11 11:49:21 UTC 2012
>Number: 172599
>Category: misc
>Synopsis: Null function pointer in ipfilter
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Thu Oct 11 11:49:20 UTC 2012
>Closed-Date:
>Last-Modified:
>Originator: Erik Cederstrand
>Release: CURRENT
>Organization:
>Environment:
>Description:
Based on Clang Static Analyzer report http://scan.freebsd.your.org/freebsd-head/LATEST/sbin/report-ivw4lE.html.gz#EndPath
There seems to be a case of inverse logic. The comment lines 2085- 2088 says the function should only be called if it is a valid pointer, but the opposite happens.
>How-To-Repeat:
>Fix:
Swap the logic. This is in line with a similar condition in line 2319.
Patch attached with submission follows:
Index: head/sys/contrib/ipfilter/netinet/fil.c
===================================================================
--- head/sys/contrib/ipfilter/netinet/fil.c (revision 241370)
+++ head/sys/contrib/ipfilter/netinet/fil.c (working copy)
@@ -2091,7 +2091,7 @@
frentry_t *frs;
ATOMIC_INC64(fr->fr_hits);
- if ((fr->fr_func != NULL) &&
+ if ((fr->fr_func == NULL) ||
(fr->fr_func == (ipfunc_t)-1))
continue;
>Release-Note:
>Audit-Trail:
>Unformatted:
More information about the freebsd-bugs
mailing list