From cd00a5e4714c42254f8039deac6b2106c10ea2ec Mon Sep 17 00:00:00 2001 From: archie Date: Wed, 5 Mar 2003 23:12:59 +0000 Subject: Fix a use-after-free bug that could cause multi-link fragment reassembly to fail for a long time (until the incoming sequence numbers wrapped around). Reported by: Matthew Impett MFC after: 3 days --- sys/netgraph/ng_ppp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'sys/netgraph/ng_ppp.c') diff --git a/sys/netgraph/ng_ppp.c b/sys/netgraph/ng_ppp.c index 6ffb082..6dfa4a4 100644 --- a/sys/netgraph/ng_ppp.c +++ b/sys/netgraph/ng_ppp.c @@ -1418,6 +1418,7 @@ ng_ppp_frag_checkstale(node_p node) meta_p meta; int i, seq; item_p item; + int endseq; now.tv_sec = 0; /* uninitialized state */ while (1) { @@ -1468,11 +1469,12 @@ ng_ppp_frag_checkstale(node_p node) } /* Extract completed packet */ + endseq = end->seq; ng_ppp_get_packet(node, &m, &meta); /* Bump MSEQ if necessary */ - if (MP_RECV_SEQ_DIFF(priv, priv->mseq, end->seq) < 0) { - priv->mseq = end->seq; + if (MP_RECV_SEQ_DIFF(priv, priv->mseq, endseq) < 0) { + priv->mseq = endseq; for (i = 0; i < priv->numActiveLinks; i++) { struct ng_ppp_link *const alink = &priv->links[priv->activeLinks[i]]; -- cgit v1.1