Avoid leaking fp references when truncating SCM_RIGHTS control messages.
Reported by: pho Approved by: so MFC after: 0 minutes Security: CVE-2019-5596 Sponsored by: The FreeBSD Foundation
This commit is contained in:
parent
762138f78f
commit
401ca034cd
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=343784
@ -1605,8 +1605,10 @@ m_dispose_extcontrolm(struct mbuf *m)
|
||||
fd = *fds++;
|
||||
error = fget(td, fd, &cap_no_rights,
|
||||
&fp);
|
||||
if (error == 0)
|
||||
if (error == 0) {
|
||||
fdclose(td, fp, fd);
|
||||
fdrop(fp, td);
|
||||
}
|
||||
}
|
||||
}
|
||||
clen -= datalen;
|
||||
|
Loading…
Reference in New Issue
Block a user