From: Ben Pfaff <blp@nicira.com>
Date: Tue, 30 Jul 2013 19:26:08 +0000 (-0700)
Subject: netdev-dummy: Fix memory leak on error path in netdev_rx_dummy_recv().
X-Git-Tag: sliver-openvswitch-2.0.90-1~33^2~42
X-Git-Url: http://git.onelab.eu/?a=commitdiff_plain;h=7d6ce2d189332aac67d65c73c582d57a17b7ac70;p=sliver-openvswitch.git

netdev-dummy: Fix memory leak on error path in netdev_rx_dummy_recv().

This code failed to free the packet if it was too big for the caller.

Signed-off-by: Ben Pfaff <blp@nicira.com>
---

diff --git a/lib/netdev-dummy.c b/lib/netdev-dummy.c
index c4f58b7a2..e7dfe9f18 100644
--- a/lib/netdev-dummy.c
+++ b/lib/netdev-dummy.c
@@ -351,7 +351,7 @@ netdev_rx_dummy_recv(struct netdev_rx *rx_, void *buffer, size_t size)
 {
     struct netdev_rx_dummy *rx = netdev_rx_dummy_cast(rx_);
     struct ofpbuf *packet;
-    size_t packet_size;
+    int retval;
 
     if (list_is_empty(&rx->recv_queue)) {
         return -EAGAIN;
@@ -359,15 +359,15 @@ netdev_rx_dummy_recv(struct netdev_rx *rx_, void *buffer, size_t size)
 
     packet = ofpbuf_from_list(list_pop_front(&rx->recv_queue));
     rx->recv_queue_len--;
-    if (packet->size > size) {
-        return -EMSGSIZE;
+    if (packet->size <= size) {
+        memcpy(buffer, packet->data, packet->size);
+        retval = packet->size;
+    } else {
+        retval = -EMSGSIZE;
     }
-    packet_size = packet->size;
-
-    memcpy(buffer, packet->data, packet->size);
     ofpbuf_delete(packet);
 
-    return packet_size;
+    return retval;
 }
 
 static void