[Bug 252504] IGMP_V3 packet with malformed number of sources is discarded but mbuf not freed

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=252504

            Bug ID: 252504
           Summary: IGMP_V3 packet with malformed number of sources is
                    discarded but mbuf not freed
           Product: Base System
           Version: Unspecified
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: kern
          Assignee: bugs at FreeBSD.org
          Reporter: panagiotis.tsolakos at gmail.com

In igmp.c, in function igmp_input(), the correctness of the incoming igmp
packet is checked. If the packet is discarded because of wrong number of
sources the mbuf is not freed.

/*
 * Validate length based on source count.
 */
nsrc = ntohs(igmpv3->igmp_numsrc);
if (nsrc * sizeof(in_addr_t) >
    UINT16_MAX - iphlen - IGMP_V3_QUERY_MINLEN) {
        IGMPSTAT_INC(igps_rcv_tooshort);
        return (IPPROTO_DONE);
}


The mbuf should be freed before the function returns:

/*
 * Validate length based on source count.
 */
nsrc = ntohs(igmpv3->igmp_numsrc);
if (nsrc * sizeof(in_addr_t) >
    UINT16_MAX - iphlen - IGMP_V3_QUERY_MINLEN) {
        IGMPSTAT_INC(igps_rcv_tooshort);
+       m_freem(m);
        return (IPPROTO_DONE);
}

-- 
You are receiving this mail because:
You are the assignee for the bug.