+-- On Fri, 11 Jan 2019, Marc-André Lureau wrote --+
| > + if (m->m_len > so_rcv->sb_datalen
| > + - (so_rcv->sb_wptr - so_rcv->sb_data)) {
| > + m_free(m);
| > + return 0;
| > + }
|
| Check looks correct, it should probably return 1.
Function comment says return 1 if 'm' is valid and should be appended via
sbappend(). Not sure if unprocessed 'm' should go to sbappend().
| Is there a reproducer?
Yes, I have one.
Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
