Initialize the TDB to NULL in ipsec_common_input() and

ipsec_{input,output}_cb() so that in the case of sending or receiving a bogus
mbuf (NULL) we don't end up trying to dereference the TDB, while being an
uninitialized pointer, to increase the drops.

Coverity IDs 1473312, 1473313 and 1473317.

OK mpi@ visa@

diff --git a/sys/netinet/ipsec_input.c b/sys/netinet/ipsec_input.c
index 785b90b..6bffa82 100644 (file)
--- a/sys/netinet/ipsec_input.c
+++ b/sys/netinet/ipsec_input.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ipsec_input.c,v 1.166 2018/08/28 15:15:02 mpi Exp $   */
+/*     $OpenBSD: ipsec_input.c,v 1.167 2018/09/14 23:40:10 mestre Exp $        */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
@@ -162,7 +162,7 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
 } while (0)
 
        union sockaddr_union dst_address;
-       struct tdb *tdbp;
+       struct tdb *tdbp = NULL;
        struct ifnet *encif;
        u_int32_t spi;
        u_int16_t cpi;
@@ -352,7 +352,7 @@ ipsec_input_cb(struct cryptop *crp)
 {
        struct tdb_crypto *tc = (struct tdb_crypto *) crp->crp_opaque;
        struct mbuf *m = (struct mbuf *) crp->crp_buf;
-       struct tdb *tdb;
+       struct tdb *tdb = NULL;
        int clen, error;
 
        if (m == NULL) {

diff --git a/sys/netinet/ipsec_output.c b/sys/netinet/ipsec_output.c
index c477793..28ff5b9 100644 (file)
--- a/sys/netinet/ipsec_output.c
+++ b/sys/netinet/ipsec_output.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ipsec_output.c,v 1.74 2018/08/28 15:15:02 mpi Exp $ */
+/*     $OpenBSD: ipsec_output.c,v 1.75 2018/09/14 23:40:10 mestre Exp $ */
 /*
  * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
  *
@@ -388,7 +388,7 @@ ipsec_output_cb(struct cryptop *crp)
 {
        struct tdb_crypto *tc = (struct tdb_crypto *) crp->crp_opaque;
        struct mbuf *m = (struct mbuf *) crp->crp_buf;
-       struct tdb *tdb;
+       struct tdb *tdb = NULL;
        int error, ilen, olen;
 
        if (m == NULL) {