Author: ngie
Date: Thu Dec 29 00:20:03 2016
New Revision: 310729
URL: https://svnweb.freebsd.org/changeset/base/310729
Log:
Prevent improper memory accesses after calling snmp_pdu_free and
snmp_value_free
snmp_pdu_free: set pdu->nbindings to 0 to limit the damage that
could happen if a pdu was reused after calling the function, and
as both stack and heap allocation types are used in contrib/bsnmp
and usr.sbin/bsnmpd.
snmp_value_free: NULL out value->v.octetstring.octets after calling
free on it to prevent a double-free from occurring.
MFC after: 2 weeks
Modified:
head/contrib/bsnmp/lib/snmp.c
Modified: head/contrib/bsnmp/lib/snmp.c
==============================================================================
--- head/contrib/bsnmp/lib/snmp.c Wed Dec 28 23:55:18 2016
(r310728)
+++ head/contrib/bsnmp/lib/snmp.c Thu Dec 29 00:20:03 2016
(r310729)
@@ -1154,8 +1154,11 @@ snmp_pdu_dump(const struct snmp_pdu *pdu
void
snmp_value_free(struct snmp_value *value)
{
- if (value->syntax == SNMP_SYNTAX_OCTETSTRING)
+
+ if (value->syntax == SNMP_SYNTAX_OCTETSTRING) {
free(value->v.octetstring.octets);
+ value->v.octetstring.octets = NULL;
+ }
value->syntax = SNMP_SYNTAX_NULL;
}
@@ -1216,6 +1219,7 @@ snmp_pdu_free(struct snmp_pdu *pdu)
for (i = 0; i < pdu->nbindings; i++)
snmp_value_free(&pdu->bindings[i]);
+ pdu->nbindings = 0;
}
/*
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
