[win-pv-devel] [PATCH] Avoid possible NULL pointer dereference

[<owen.smith@xxxxxxxxxx>]

From: Owen Smith <owen.smith@xxxxxxxxxx>

If the packet cache is exhausted and unable to allocate more items,
fail before attempting to use the pointer. Moves the check to after
attempting to get a packet cache item.

Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>
---
 src/xenvif/receiver.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/src/xenvif/receiver.c b/src/xenvif/receiver.c
index 07fa642..14ff52a 100644
--- a/src/xenvif/receiver.c
+++ b/src/xenvif/receiver.c
@@ -1198,7 +1198,14 @@ ReceiverRingProcessPacket(
     // Get a new packet structure that will just contain the header after
     // parsing. We need to preserve metadata from the original.
 
+    status = STATUS_NO_MEMORY;
     New = __ReceiverRingGetPacket(Ring, TRUE);
+    if (New == NULL) {
+        FrontendIncrementStatistic(Frontend,
+            XENVIF_RECEIVER_FRONTEND_ERRORS,
+            1);
+        goto fail1;
+    }
 
     RtlCopyMemory(New,
                   Packet,
@@ -1209,14 +1216,6 @@ ReceiverRingProcessPacket(
     // Override offset to align
     Packet->Offset = Receiver->IpAlignOffset;
 
-    status = STATUS_NO_MEMORY;
-    if (Packet == NULL) {
-        FrontendIncrementStatistic(Frontend,
-                                   XENVIF_RECEIVER_FRONTEND_ERRORS,
-                                   1);
-        goto fail1;
-    }
-
     StartVa = MmGetSystemAddressForMdlSafe(&Packet->Mdl, NormalPagePriority);
     ASSERT(StartVa != NULL);
     StartVa += Packet->Offset;
-- 
2.8.3


_______________________________________________
win-pv-devel mailing list
win-pv-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/cgi-bin/mailman/listinfo/win-pv-devel