diff options
| author | Xin LI <delphij@FreeBSD.org> | 2017-06-25 06:55:42 +0000 |
|---|---|---|
| committer | Xin LI <delphij@FreeBSD.org> | 2017-06-25 06:55:42 +0000 |
| commit | a24378b232876b893550caa4d6c7452353e9da6f (patch) | |
| tree | 94e4ced450d4f1658e37bef290eaab420e6f4100 /lib | |
| parent | d47dcc58c2e4fbd68a788dc0659e2215be851786 (diff) | |
MFC r320216: Fix use-after-free introduced in r300388.
In r300388, endnetconfig() was called on nc_handle which would release
the associated netconfig structure, which means tmpnconf->nc_netid
would be a use-after-free.
Solve this by doing endnetconfig() in return paths instead.
Reported by: jemalloc via kevlo
Reviewed by: cem, ngie (earlier version)
Notes
svn path=/stable/9/; revision=320326
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/libc/rpc/rpcb_clnt.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/libc/rpc/rpcb_clnt.c b/lib/libc/rpc/rpcb_clnt.c index da7f014fc824..46bdc0698362 100644 --- a/lib/libc/rpc/rpcb_clnt.c +++ b/lib/libc/rpc/rpcb_clnt.c @@ -508,14 +508,15 @@ try_nconf: hostname = IN6_LOCALHOST_STRING; } } - endnetconfig(nc_handle); if (tmpnconf == NULL) { + endnetconfig(nc_handle); rpc_createerr.cf_stat = RPC_UNKNOWNPROTO; mutex_unlock(&loopnconf_lock); return (NULL); } loopnconf = getnetconfigent(tmpnconf->nc_netid); /* loopnconf is never freed */ + endnetconfig(nc_handle); } mutex_unlock(&loopnconf_lock); client = getclnthandle(hostname, loopnconf, NULL); |