Bug 1439236: exit early if m_copym gets called with null ptr draft
authorNils Ohlmeier [:drno] <drno@ohlmeier.org>
Wed, 16 May 2018 09:51:35 -0700
changeset 797043 1ce5046945872b8e6911d99a9eef6c48e2759b54
parent 795657 3c9d69736f4a421218e5eb01b6571d535d38318a
push id110416
push userdrno@ohlmeier.org
push dateFri, 18 May 2018 17:30:16 +0000
bugs1439236
milestone62.0a1
Bug 1439236: exit early if m_copym gets called with null ptr Cheery-picked upstream commit: https://github.com/sctplab/usrsctp/commit/d89882d04900c80860874b5eb389b3ed3a0bca3d MozReview-Commit-ID: 36bYbfIaqEz
netwerk/sctp/src/user_mbuf.c
--- a/netwerk/sctp/src/user_mbuf.c
+++ b/netwerk/sctp/src/user_mbuf.c
@@ -982,16 +982,23 @@ m_copym(struct mbuf *m, int off0, int le
 {
 	struct mbuf *n, **np;
 	int off = off0;
 	struct mbuf *top;
 	int copyhdr = 0;
 
 	KASSERT(off >= 0, ("m_copym, negative off %d", off));
 	KASSERT(len >= 0, ("m_copym, negative len %d", len));
+	KASSERT(m != NULL, ("m_copym, m is NULL"));
+
+#if !defined(INVARIANTS)
+	if (m == NULL) {
+		return (NULL);
+	}
+#endif
 
 	if (off == 0 && m->m_flags & M_PKTHDR)
 		copyhdr = 1;
 	while (off > 0) {
 		KASSERT(m != NULL, ("m_copym, offset > size of mbuf chain"));
 		if (off < m->m_len)
 			break;
 		off -= m->m_len;