d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Prevent improper memory accesses after calling snmp_pdu_free and snmp_value_free

Browse Source 
snmp_pdu_free: set pdu->nbindings to 0 to limit the damage that
could happen if a pdu was reused after calling the function, and
as both stack and heap allocation types are used in contrib/bsnmp
and usr.sbin/bsnmpd.

snmp_value_free: NULL out value->v.octetstring.octets after calling
free on it to prevent a double-free from occurring.

MFC after:      2 weeks
This commit is contained in:
ngie 2016-12-29 00:20:03 +00:00
parent f3b7ca776a
commit 4093156173
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
contrib/bsnmp/lib/snmp.c
View File

@ -1154,8 +1154,11 @@ snmp_pdu_dump(const struct snmp_pdu *pdu)
void
snmp_value_free(struct snmp_value *value)
{
if (value->syntax == SNMP_SYNTAX_OCTETSTRING)
if (value->syntax == SNMP_SYNTAX_OCTETSTRING) {
free(value->v.octetstring.octets);
value->v.octetstring.octets = NULL;
}
value->syntax = SNMP_SYNTAX_NULL;
}
@ -1216,6 +1219,7 @@ snmp_pdu_free(struct snmp_pdu *pdu)
for (i = 0; i < pdu->nbindings; i++)
snmp_value_free(&pdu->bindings[i]);
pdu->nbindings = 0;
}
/*