rtadvd(8): Don't use-after-free
This whole block of code as committed fully formed in r224144. I'm not really sure what the intent was, but it seems plausible that !persist ifis could need other member cleanup. Don't free the object until after we've finished cleaning its members. Reported by: Coverity CID: 1006079 Sponsored by: EMC / Isilon Storage Division
This commit is contained in:
parent
021b92e5ba
commit
5c4eb89746
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=299513
@ -234,7 +234,6 @@ rm_ifinfo(struct ifinfo *ifi)
|
|||||||
TAILQ_REMOVE(&ifilist, ifi, ifi_next);
|
TAILQ_REMOVE(&ifilist, ifi, ifi_next);
|
||||||
syslog(LOG_DEBUG, "<%s>: ifinfo (idx=%d) removed.",
|
syslog(LOG_DEBUG, "<%s>: ifinfo (idx=%d) removed.",
|
||||||
__func__, ifi->ifi_ifindex);
|
__func__, ifi->ifi_ifindex);
|
||||||
free(ifi);
|
|
||||||
} else {
|
} else {
|
||||||
/* recreate an empty entry */
|
/* recreate an empty entry */
|
||||||
update_persist_ifinfo(&ifilist, ifi->ifi_ifname);
|
update_persist_ifinfo(&ifilist, ifi->ifi_ifname);
|
||||||
@ -278,6 +277,8 @@ rm_ifinfo(struct ifinfo *ifi)
|
|||||||
}
|
}
|
||||||
|
|
||||||
syslog(LOG_DEBUG, "<%s> leave (%s).", __func__, ifi->ifi_ifname);
|
syslog(LOG_DEBUG, "<%s> leave (%s).", __func__, ifi->ifi_ifname);
|
||||||
|
if (!ifi->ifi_persist)
|
||||||
|
free(ifi);
|
||||||
return (0);
|
return (0);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user