diff options
| author | markj <markj@FreeBSD.org> | 2016-02-12 20:43:53 +0000 |
|---|---|---|
| committer | markj <markj@FreeBSD.org> | 2016-02-12 20:43:53 +0000 |
| commit | c39d0036aec3c0e07779d2b299622d9ca6236655 (patch) | |
| tree | 1ee86a85785a6c517a0c97af430dd6915da9901c /contrib/llvm/lib/Target/WebAssembly/WebAssemblyCFGStackify.cpp | |
| parent | 1dbbdb820af887972a0c03e197d18b97bbaba3bb (diff) | |
| download | FreeBSD-src-c39d0036aec3c0e07779d2b299622d9ca6236655.zip FreeBSD-src-c39d0036aec3c0e07779d2b299622d9ca6236655.tar.gz | |
Clear the cookie pointer on error in tmpfs_readdir().
It is otherwise left dangling, and callers that request cookies always free
the cookie buffer, even when VOP_READDIR(9) returns an error. This results
in a double free if tmpfs_readdir() returns an error to the NFS server or
the Linux getdents(2) emulation code.
Reported by: pho
MFC after: 1 week
Security: double free of malloc(9)-backed memory
Sponsored by: EMC / Isilon Storage Division
Diffstat (limited to 'contrib/llvm/lib/Target/WebAssembly/WebAssemblyCFGStackify.cpp')
0 files changed, 0 insertions, 0 deletions
