[src/netbsd-1-5]: src/usr.sbin/dhcp/server Pull up revision 1.1.1.8 (requeste...

[he <he%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/0b8a547f55d5
branches:  netbsd-1-5
changeset: 491274:0b8a547f55d5
user:      he <he%NetBSD.org@localhost>
date:      Sat Apr 21 19:47:41 2001 +0000

description:
Pull up revision 1.1.1.8 (requested by mellon):
  Fix a potential memory smash.

diffstat:

 usr.sbin/dhcp/server/failover.c |  7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diffs (38 lines):

diff -r f342d52ea25d -r 0b8a547f55d5 usr.sbin/dhcp/server/failover.c
--- a/usr.sbin/dhcp/server/failover.c   Sat Apr 21 19:46:19 2001 +0000
+++ b/usr.sbin/dhcp/server/failover.c   Sat Apr 21 19:47:41 2001 +0000
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: failover.c,v 1.1.1.2.2.3 2001/04/04 20:55:52 he Exp $ Copyright (c) 1999-2001 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: failover.c,v 1.1.1.2.2.4 2001/04/21 19:47:41 he Exp $ Copyright (c) 1999-2001 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -360,6 +360,7 @@
                        return ISC_R_UNEXPECTED;
                }
                memset (link -> imsg, 0, sizeof (failover_message_t));
+               link -> imsg -> refcnt = 1;
                /* Get the length: */
                omapi_connection_get_uint16 (c, &link -> imsg_len);
                link -> imsg_count = 0; /* Bytes read. */
@@ -2144,7 +2145,8 @@
                failover_message_dereference (&msg, MDL);
        }
 
-       failover_message_dereference (&state -> toack_queue_tail, MDL);
+       if (state -> toack_queue_tail)
+               failover_message_dereference (&state -> toack_queue_tail, MDL);
        state -> pending_acks = 0;
 
        return 1;
@@ -4721,6 +4723,7 @@
        if ((*mp) -> refcnt == 0) {
                dfree (*mp, MDL);
        }
+       *mp = 0;
        return ISC_R_SUCCESS;
 }