svn commit: r333637 - head/sys/netinet

[Stephen Hurd]

Author: shurd
Date: Tue May 15 16:54:41 2018
New Revision: 333637
URL: https://svnweb.freebsd.org/changeset/base/333637

Log:
  Check that ifma_protospec != NULL in inm_lookup
  
  If ifma_protospec is NULL when inm_lookup() is called, there
  is a dereference in a NULL struct pointer. This ensures that struct is
  not NULL before comparing the address.
  
  Reported by:	dumbbell
  Reviewed by:	sbruno
  Sponsored by:	Limelight Networks
  Differential Revision:	https://reviews.freebsd.org/D15440

Modified:
  head/sys/netinet/in_mcast.c

Modified: head/sys/netinet/in_mcast.c
==============================================================================
--- head/sys/netinet/in_mcast.c	Tue May 15 16:44:35 2018	(r333636)
+++ head/sys/netinet/in_mcast.c	Tue May 15 16:54:41 2018	(r333637)
@@ -344,12 +344,13 @@ inm_lookup_locked(struct ifnet *ifp, const struct in_a
 
 	inm = NULL;
 	TAILQ_FOREACH(ifma, &((ifp)->if_multiaddrs), ifma_link) {
-		if (ifma->ifma_addr->sa_family == AF_INET) {
-			inm = (struct in_multi *)ifma->ifma_protospec;
-			if (inm->inm_addr.s_addr == ina.s_addr)
-				break;
-			inm = NULL;
-		}
+		if (ifma->ifma_addr->sa_family != AF_INET ||
+		    ifma->ifma_protospec == NULL)
+			continue;
+		inm = (struct in_multi *)ifma->ifma_protospec;
+		if (inm->inm_addr.s_addr == ina.s_addr)
+			break;
+		inm = NULL;
 	}
 	return (inm);
 }