The branch main has been updated by cy:
URL:
https://cgit.FreeBSD.org/src/commit/?id=323a4e2c4e285e6f8eee8db3fe2cb7490a734da0
commit 323a4e2c4e285e6f8eee8db3fe2cb7490a734da0
Author: Cy Schubert <c...@freebsd.org>
AuthorDate: 2021-05-25 18:54:49 +0000
Commit: Cy Schubert <c...@freebsd.org>
CommitDate: 2021-05-25 18:58:14 +0000
ipfilter: Fix ip_nat memory leak and use-after-free
Unfortunately the wrong elemet is freed, also resulting in use-after-free.
PR: 255859
Submitted by: lylg...@foxmail.com
Reported by: lylg...@foxmail.com
MFC after: 3 days
---
sys/contrib/ipfilter/netinet/ip_nat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sys/contrib/ipfilter/netinet/ip_nat.c
b/sys/contrib/ipfilter/netinet/ip_nat.c
index 41e51880b3dd..0475a4386079 100644
--- a/sys/contrib/ipfilter/netinet/ip_nat.c
+++ b/sys/contrib/ipfilter/netinet/ip_nat.c
@@ -6245,7 +6245,7 @@ ipf_nat_rule_deref(softc, inp)
if (n->in_tqehead[0] != NULL) {
if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
- ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
+ ipf_freetimeoutqueue(softc, n->in_tqehead[0]);
}
}
_______________________________________________
dev-commits-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/dev-commits-src-all
To unsubscribe, send any mail to "dev-commits-src-all-unsubscr...@freebsd.org"
