tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: infinite recursion in m_split()

On Fri, Apr 03, 2009 at 01:22:30AM +0000, YAMAMOTO Takashi wrote:
> > Documentatio doesn't mention that calling m_split() with a 0 len0 is 
> > invalid.
> > My fix is to check for (len0 == 0) in m_split() and return m0 in this case.
> > Is it OK ?
> the fix seems wrong because the caller of m_split will keep a reference to
> the original m0 as well and it will be double-freed eventually.
> i think it's more straightforward to fix nfsrv_getstream.

Right, it appeared to me this morning (sleep gives good things sometimes :)
The obvious place to fix it is indeed nfsrv_getstream() and add a KASSERT
in m_split() (and update the documentation).

To bring the implementation in sync with the documentation we would need to
return a copy of m0 in this case, but this may be overkill. It's better
to let the caller deal with it.

Manuel Bouyer, LIP6, Universite Paris VI.  
     NetBSD: 26 ans d'experience feront toujours la difference

Home | Main Index | Thread Index | Old Index