[src/netbsd-8]: src/sys/netipsec Pull up following revision(s) (requested by ...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/fa600b12f56c
branches:  netbsd-8
changeset: 434793:fa600b12f56c
user:      martin <martin%NetBSD.org@localhost>
date:      Fri Mar 30 11:53:13 2018 +0000

description:
Pull up following revision(s) (requested by maxv in ticket #670):

        sys/netipsec/xform_esp.c: revision 1.73

Add missing NULL check. Normally that's not triggerable remotely, since we
are guaranteed that 8 bytes are valid at mbuf+skip.

diffstat:

 sys/netipsec/xform_esp.c |  8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diffs (29 lines):

diff -r 4b4f9ed6c264 -r fa600b12f56c sys/netipsec/xform_esp.c
--- a/sys/netipsec/xform_esp.c  Fri Mar 30 11:50:56 2018 +0000
+++ b/sys/netipsec/xform_esp.c  Fri Mar 30 11:53:13 2018 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: xform_esp.c,v 1.55.2.2 2018/02/26 13:10:52 martin Exp $        */
+/*     $NetBSD: xform_esp.c,v 1.55.2.3 2018/03/30 11:53:13 martin Exp $        */
 /*     $FreeBSD: src/sys/netipsec/xform_esp.c,v 1.2.2.1 2003/01/24 05:11:36 sam Exp $  */
 /*     $OpenBSD: ip_esp.c,v 1.69 2001/06/26 06:18:59 angelos Exp $ */
 
@@ -39,7 +39,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.55.2.2 2018/02/26 13:10:52 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: xform_esp.c,v 1.55.2.3 2018/03/30 11:53:13 martin Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
@@ -319,6 +319,10 @@
 
        /* XXX don't pullup, just copy header */
        IP6_EXTHDR_GET(esp, struct newesp *, m, skip, sizeof(struct newesp));
+       if (esp == NULL) {
+               /* m already freed */
+               return EINVAL;
+       }
 
        esph = sav->tdb_authalgxform;
        espx = sav->tdb_encalgxform;