d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

pdu_delete(request) frees request, so move the call after

Browse Source 
login_new_response(request) to avoid a use-after-free error

Reported by:	Coverity
Reviewed by:	1331219, 1331220
This commit is contained in:
Don Lewis 2016-05-16 04:43:47 +00:00
parent 8f2c79ef85
commit ec77f107fa
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=299894
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
usr.sbin/ctld/login.c
View File

@ -767,10 +767,10 @@ login_wait_transition(struct connection *conn)
login_send_error(request, 0x02, 0x00);
log_errx(1, "got no \"T\" flag after answering AuthMethod");
}
pdu_delete(request);
log_debugx("got state transition request");
response = login_new_response(request);
pdu_delete(request);
login_set_nsg(response, BHSLR_STAGE_OPERATIONAL_NEGOTIATION);
pdu_send(response);
pdu_delete(response);