diff options
author | Ben Pfaff <blp@nicira.com> | 2013-07-30 12:26:08 -0700 |
---|---|---|
committer | Ben Pfaff <blp@nicira.com> | 2013-08-02 12:24:18 -0700 |
commit | 7d6ce2d189332aac67d65c73c582d57a17b7ac70 (patch) | |
tree | d4ffe07c7a22d56378220077630470469a048325 /lib/netdev-dummy.c | |
parent | 2e5ae318d522ce2cf2c6424958f27fce4f8b7ae7 (diff) |
netdev-dummy: Fix memory leak on error path in netdev_rx_dummy_recv().
This code failed to free the packet if it was too big for the caller.
Signed-off-by: Ben Pfaff <blp@nicira.com>
Diffstat (limited to 'lib/netdev-dummy.c')
-rw-r--r-- | lib/netdev-dummy.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/lib/netdev-dummy.c b/lib/netdev-dummy.c index c4f58b7a..e7dfe9f1 100644 --- a/lib/netdev-dummy.c +++ b/lib/netdev-dummy.c @@ -351,7 +351,7 @@ netdev_rx_dummy_recv(struct netdev_rx *rx_, void *buffer, size_t size) { struct netdev_rx_dummy *rx = netdev_rx_dummy_cast(rx_); struct ofpbuf *packet; - size_t packet_size; + int retval; if (list_is_empty(&rx->recv_queue)) { return -EAGAIN; @@ -359,15 +359,15 @@ netdev_rx_dummy_recv(struct netdev_rx *rx_, void *buffer, size_t size) packet = ofpbuf_from_list(list_pop_front(&rx->recv_queue)); rx->recv_queue_len--; - if (packet->size > size) { - return -EMSGSIZE; + if (packet->size <= size) { + memcpy(buffer, packet->data, packet->size); + retval = packet->size; + } else { + retval = -EMSGSIZE; } - packet_size = packet->size; - - memcpy(buffer, packet->data, packet->size); ofpbuf_delete(packet); - return packet_size; + return retval; } static void |