hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-11-27 03:11:52 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

In fill_ip6(), the value of the pointer av changes before it is

Browse Source 
free(3)ed. Thus, introduce a new variable to track the original
value.

Submitted by:		Tom Rix
Differential Revision:	https://reviews.freebsd.org/D9962
This commit is contained in:
Marius Strobl 2017-04-23 21:17:59 +00:00
parent 10be945708
commit 247cea8f9c
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=317343
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sbin/ipfw/ipv6.c
View File

@ -339,6 +339,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen, struct tidx *tstate)
{
int len = 0;
struct in6_addr *d = &(cmd->addr6);
char *oav;
/*
* Needed for multiple address.
* Note d[1] points to struct in6_add r mask6 of cmd
@ -365,7 +366,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen, struct tidx *tstate)
return (1);
}
av = strdup(av);
oav = av = strdup(av);
while (av) {
/*
* After the address we can have '/' indicating a mask,
@ -446,7 +447,7 @@ fill_ip6(ipfw_insn_ip6 *cmd, char *av, int cblen, struct tidx *tstate)
if (len + 1 > F_LEN_MASK)
errx(EX_DATAERR, "address list too long");
cmd->o.len |= len+1;
free(av);
free(oav);
return (1);
}