From 7d6ce2d189332aac67d65c73c582d57a17b7ac70 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Tue, 30 Jul 2013 12:26:08 -0700 Subject: [PATCH] netdev-dummy: Fix memory leak on error path in netdev_rx_dummy_recv(). This code failed to free the packet if it was too big for the caller. Signed-off-by: Ben Pfaff --- lib/netdev-dummy.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/lib/netdev-dummy.c b/lib/netdev-dummy.c index c4f58b7a2..e7dfe9f18 100644 --- a/lib/netdev-dummy.c +++ b/lib/netdev-dummy.c @@ -351,7 +351,7 @@ netdev_rx_dummy_recv(struct netdev_rx *rx_, void *buffer, size_t size) { struct netdev_rx_dummy *rx = netdev_rx_dummy_cast(rx_); struct ofpbuf *packet; - size_t packet_size; + int retval; if (list_is_empty(&rx->recv_queue)) { return -EAGAIN; @@ -359,15 +359,15 @@ netdev_rx_dummy_recv(struct netdev_rx *rx_, void *buffer, size_t size) packet = ofpbuf_from_list(list_pop_front(&rx->recv_queue)); rx->recv_queue_len--; - if (packet->size > size) { - return -EMSGSIZE; + if (packet->size <= size) { + memcpy(buffer, packet->data, packet->size); + retval = packet->size; + } else { + retval = -EMSGSIZE; } - packet_size = packet->size; - - memcpy(buffer, packet->data, packet->size); ofpbuf_delete(packet); - return packet_size; + return retval; } static void -- 2.47.0