View | Details | Raw Unified | Return to bug 17583
Collapse All | Expand All

(-)aarp.c (-2 / +10 lines)
Lines 393-404 Link Here
393
		sizeof( ea->aarp_sha ));
393
		sizeof( ea->aarp_sha ));
394
	aat->aat_flags |= ATF_COM;
394
	aat->aat_flags |= ATF_COM;
395
	if ( aat->aat_hold ) {
395
	if ( aat->aat_hold ) {
396
	    struct mbuf *mhold;
397
398
	    /*
399
	     * We must NULL out the aat->aat_hold pointer, since otherwise
400
	     * if_output may call aarpresolve() which could m_freem() it.
401
	     */
402
	    mhold = aat->aat_hold;
403
	    aat->aat_hold = NULL;
404
396
	    sat.sat_len = sizeof(struct sockaddr_at);
405
	    sat.sat_len = sizeof(struct sockaddr_at);
397
	    sat.sat_family = AF_APPLETALK;
406
	    sat.sat_family = AF_APPLETALK;
398
	    sat.sat_addr = spa;
407
	    sat.sat_addr = spa;
399
	    (*ac->ac_if.if_output)( &ac->ac_if, aat->aat_hold,
408
	    (*ac->ac_if.if_output)( &ac->ac_if, mhold,
400
		    (struct sockaddr *)&sat, NULL); /* XXX */
409
		    (struct sockaddr *)&sat, NULL); /* XXX */
401
	    aat->aat_hold = 0;
402
	}
410
	}
403
    }
411
    }

Return to bug 17583