d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix use-after-free introduced in r300388.

Browse Source 
In r300388, endnetconfig() was called on nc_handle which would release
the associated netconfig structure, which means tmpnconf->nc_netid
would be a use-after-free.

Solve this by doing endnetconfig() in return paths instead.

Reported by:	jemalloc via kevlo
Reviewed by:	cem, ngie (earlier version)
MFC after:	3 days
Differential Revision:    https://reviews.freebsd.org/D11288
This commit is contained in:
delphij 2017-06-22 05:10:16 +00:00
parent ec2f485e30
commit 1fa9b754c4
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/libc/rpc/rpcb_clnt.c
View File

@ -499,14 +499,15 @@ local_rpcb(void)
hostname = IN6_LOCALHOST_STRING;
}
}
endnetconfig(nc_handle);
if (tmpnconf == NULL) {
endnetconfig(nc_handle);
rpc_createerr.cf_stat = RPC_UNKNOWNPROTO;
mutex_unlock(&loopnconf_lock);
return (NULL);
}
loopnconf = getnetconfigent(tmpnconf->nc_netid);
/* loopnconf is never freed */
endnetconfig(nc_handle);
}
mutex_unlock(&loopnconf_lock);
client = getclnthandle(hostname, loopnconf, NULL);