From 2196d98ea09e3deb53af59acbf7cbaccc561a15b Mon Sep 17 00:00:00 2001 From: Hans Petter Selasky Date: Fri, 28 Sep 2012 16:23:01 +0000 Subject: Make sure we don't leak a mbuf in a fail case. --- sys/dev/usb/net/if_smsc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'sys/dev') diff --git a/sys/dev/usb/net/if_smsc.c b/sys/dev/usb/net/if_smsc.c index 5f2acfbad2c7f..07874efb460fb 100644 --- a/sys/dev/usb/net/if_smsc.c +++ b/sys/dev/usb/net/if_smsc.c @@ -1043,8 +1043,11 @@ smsc_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error) /* Finally enqueue the mbuf on the receive queue */ /* Remove 4 trailing bytes */ - if (pktlen >= (4 + ETHER_HDR_LEN)) - uether_rxmbuf(ue, m, pktlen - 4); + if (pktlen < (4 + ETHER_HDR_LEN)) { + m_freem(m); + goto tr_setup; + } + uether_rxmbuf(ue, m, pktlen - 4); } /* Update the offset to move to the next potential packet */ -- cgit v1.3