d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

rtadvd(8): Don't use-after-free

Browse Source 
This whole block of code as committed fully formed in r224144.  I'm not really
sure what the intent was, but it seems plausible that !persist ifis could need
other member cleanup.  Don't free the object until after we've finished
cleaning its members.

Reported by:	Coverity
CID:		1006079
Sponsored by:	EMC / Isilon Storage Division
This commit is contained in:
Conrad Meyer 2016-05-12 04:54:32 +00:00
parent 021b92e5ba
commit 5c4eb89746
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=299513
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
usr.sbin/rtadvd/config.c
View File

@ -234,7 +234,6 @@ rm_ifinfo(struct ifinfo *ifi)
TAILQ_REMOVE(&ifilist, ifi, ifi_next);
syslog(LOG_DEBUG, "<%s>: ifinfo (idx=%d) removed.",
__func__, ifi->ifi_ifindex);
free(ifi);
} else {
/* recreate an empty entry */
update_persist_ifinfo(&ifilist, ifi->ifi_ifname);
@ -278,6 +277,8 @@ rm_ifinfo(struct ifinfo *ifi)
}
syslog(LOG_DEBUG, "<%s> leave (%s).", __func__, ifi->ifi_ifname);
if (!ifi->ifi_persist)
free(ifi);
return (0);
}