d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix use after free bug: use temporary variable to hold next entry in linked

Browse Source 
list while freeing current entry, rather than using the free'd entry's next
pointer.

Found with:	Coverity Prevent(tm)
CID:		1333
This commit is contained in:
Robert Watson 2007-04-03 12:45:10 +00:00
parent afd894bb12
commit 6246c6e2a7
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/netatm/atm_if.c
View File

@ -169,7 +169,7 @@ atm_physif_deregister(cup)
Cmn_unit *cup;
{
struct atm_pif *pip = (struct atm_pif *)&cup->cu_pif;
Cmn_vcc *cvp;
Cmn_vcc *cvp, *cvp_next;
int err;
int s = splnet();
@ -215,8 +215,9 @@ atm_physif_deregister(cup)
*/
cvp = cup->cu_vcc;
while (cvp) {
cvp_next = cvp->cv_next;
uma_zfree(cup->cu_vcc_zone, cvp);
cvp = cvp->cv_next;
cvp = cvp_next;
}
cup->cu_vcc = (Cmn_vcc *)NULL;