Avoid possible NULL pointer dereference

If the packet cache is exhausted and unable to allocate more items, fail
before attempting to use the pointer. Moves the check to after
attempting to get a packet cache item.

Signed-off-by: Owen Smith <owen.smith@citrix.com>
Slight re-structuring of the error check.

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>

diff --git a/src/xenvif/receiver.c b/src/xenvif/receiver.c
index 07fa642451c83ac7a5557833390a3175dd522d48..25bf40aa00df1d3c0f3646065e4a1bbb67c4c097 100644 (file)
--- a/src/xenvif/receiver.c
+++ b/src/xenvif/receiver.c
@@ -1200,6 +1200,14 @@ ReceiverRingProcessPacket(
 
     New = __ReceiverRingGetPacket(Ring, TRUE);
 
+    status = STATUS_NO_MEMORY;
+    if (New == NULL) {
+        FrontendIncrementStatistic(Frontend,
+            XENVIF_RECEIVER_FRONTEND_ERRORS,
+            1);
+        goto fail1;
+    }
+
     RtlCopyMemory(New,
                   Packet,
                   FIELD_OFFSET(XENVIF_RECEIVER_PACKET, Mdl));
@@ -1209,14 +1217,6 @@ ReceiverRingProcessPacket(
     // Override offset to align
     Packet->Offset = Receiver->IpAlignOffset;
 
-    status = STATUS_NO_MEMORY;
-    if (Packet == NULL) {
-        FrontendIncrementStatistic(Frontend,
-                                   XENVIF_RECEIVER_FRONTEND_ERRORS,
-                                   1);
-        goto fail1;
-    }
-
     StartVa = MmGetSystemAddressForMdlSafe(&Packet->Mdl, NormalPagePriority);
     ASSERT(StartVa != NULL);
     StartVa += Packet->Offset;