d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a use after free in update_rtm_from_rc().

Browse Source 
update_rtm_from_rc() calls update_rtm_from_info() internally.
The latter one may update provided prtm pointer with a new rtm.
Reassign rtm from prtm afeter calling update_rtm_from_info() to
 avoid touching the freed rtm.

PR:		255871
Submitted by:	lylgood@foxmail.com
MFC after:	3 days
This commit is contained in:
Alexander V. Chernikov 2021-05-14 16:03:08 +00:00
parent 852088f6af
commit 76cfc6fa0d
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sys/net/rtsock.c
View File

@ -976,6 +976,7 @@ update_rtm_from_rc(struct rt_addrinfo *info, struct rt_msghdr **prtm,
if ((error = update_rtm_from_info(info, prtm, alloc_len)) != 0)
return (error);
rtm = *prtm;
rtm->rtm_flags = rc->rc_rt->rte_flags | nhop_get_rtflags(nh);
if (rtm->rtm_flags & RTF_GWFLAG_COMPAT)
rtm->rtm_flags = RTF_GATEWAY |