diff options
| author | rwatson <rwatson@FreeBSD.org> | 2007-04-03 12:45:10 +0000 |
|---|---|---|
| committer | rwatson <rwatson@FreeBSD.org> | 2007-04-03 12:45:10 +0000 |
| commit | ea5253bc2b5ad50d4d5b4d295cd13280e8b63444 (patch) | |
| tree | 074dbdad73d79afcec0457349499bafb6366fb6f | |
| parent | aa77196921f69a4eb73485ea4427f20744577fea (diff) | |
| download | FreeBSD-src-ea5253bc2b5ad50d4d5b4d295cd13280e8b63444.zip FreeBSD-src-ea5253bc2b5ad50d4d5b4d295cd13280e8b63444.tar.gz | |
Fix use after free bug: use temporary variable to hold next entry in linked
list while freeing current entry, rather than using the free'd entry's next
pointer.
Found with: Coverity Prevent(tm)
CID: 1333
| -rw-r--r-- | sys/netatm/atm_if.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/sys/netatm/atm_if.c b/sys/netatm/atm_if.c index cdf4960..665e7c0 100644 --- a/sys/netatm/atm_if.c +++ b/sys/netatm/atm_if.c @@ -169,7 +169,7 @@ atm_physif_deregister(cup) Cmn_unit *cup; { struct atm_pif *pip = (struct atm_pif *)&cup->cu_pif; - Cmn_vcc *cvp; + Cmn_vcc *cvp, *cvp_next; int err; int s = splnet(); @@ -215,8 +215,9 @@ atm_physif_deregister(cup) */ cvp = cup->cu_vcc; while (cvp) { + cvp_next = cvp->cv_next; uma_zfree(cup->cu_vcc_zone, cvp); - cvp = cvp->cv_next; + cvp = cvp_next; } cup->cu_vcc = (Cmn_vcc *)NULL; |
