diff options
| author | mlaier <mlaier@FreeBSD.org> | 2011-02-10 01:24:09 +0000 |
|---|---|---|
| committer | mlaier <mlaier@FreeBSD.org> | 2011-02-10 01:24:09 +0000 |
| commit | f0ab2e35d4d39875b95507a297181c956a50465a (patch) | |
| tree | ea62268f02eedd891d6f4ac1d25aa16f02e665eb /sys/net | |
| parent | 35ebea3dcf4a9ea5ee086e7d51f1b4888520125a (diff) | |
| download | FreeBSD-src-f0ab2e35d4d39875b95507a297181c956a50465a.zip FreeBSD-src-f0ab2e35d4d39875b95507a297181c956a50465a.tar.gz | |
As info.rti_info[RTAX_DST] can point inside of rtm we must not free the rtm
until rt_dispatch is done with the sockaddr.
Found by: memguard
MFC after: 3 days
Diffstat (limited to 'sys/net')
| -rw-r--r-- | sys/net/rtsock.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c index f2b0369..999557a 100644 --- a/sys/net/rtsock.c +++ b/sys/net/rtsock.c @@ -883,7 +883,6 @@ flush: m = NULL; } else if (m->m_pkthdr.len > rtm->rtm_msglen) m_adj(m, rtm->rtm_msglen - m->m_pkthdr.len); - Free(rtm); } if (m) { if (rp) { @@ -898,6 +897,9 @@ flush: } else rt_dispatch(m, info.rti_info[RTAX_DST]); } + /* info.rti_info[RTAX_DST] (used above) can point inside of rtm */ + if (rtm) + Free(rtm); } return (error); #undef sa_equal |
