From 4093156173132fa20a07ae574a2a20a9134f619d Mon Sep 17 00:00:00 2001 From: ngie Date: Thu, 29 Dec 2016 00:20:03 +0000 Subject: [PATCH] Prevent improper memory accesses after calling snmp_pdu_free and snmp_value_free snmp_pdu_free: set pdu->nbindings to 0 to limit the damage that could happen if a pdu was reused after calling the function, and as both stack and heap allocation types are used in contrib/bsnmp and usr.sbin/bsnmpd. snmp_value_free: NULL out value->v.octetstring.octets after calling free on it to prevent a double-free from occurring. MFC after: 2 weeks --- contrib/bsnmp/lib/snmp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/contrib/bsnmp/lib/snmp.c b/contrib/bsnmp/lib/snmp.c index ae67fc403b28..d1dabc8884a0 100644 --- a/contrib/bsnmp/lib/snmp.c +++ b/contrib/bsnmp/lib/snmp.c @@ -1154,8 +1154,11 @@ snmp_pdu_dump(const struct snmp_pdu *pdu) void snmp_value_free(struct snmp_value *value) { - if (value->syntax == SNMP_SYNTAX_OCTETSTRING) + + if (value->syntax == SNMP_SYNTAX_OCTETSTRING) { free(value->v.octetstring.octets); + value->v.octetstring.octets = NULL; + } value->syntax = SNMP_SYNTAX_NULL; } @@ -1216,6 +1219,7 @@ snmp_pdu_free(struct snmp_pdu *pdu) for (i = 0; i < pdu->nbindings; i++) snmp_value_free(&pdu->bindings[i]); + pdu->nbindings = 0; } /*