Date: Thu, 3 Jun 2021 00:57:52 GMT From: Cy Schubert <cy@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: c8773c8018e7 - stable/12 - ipfilter: Fix ip_nat memory leak and use-after-free Message-ID: <202106030057.1530vq3A020161@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=c8773c8018e74a34a5d9e7ec6d66f4311148f975 commit c8773c8018e74a34a5d9e7ec6d66f4311148f975 Author: Cy Schubert <cy@FreeBSD.org> AuthorDate: 2021-05-25 18:54:49 +0000 Commit: Cy Schubert <cy@FreeBSD.org> CommitDate: 2021-06-03 00:57:45 +0000 ipfilter: Fix ip_nat memory leak and use-after-free Unfortunately the wrong elemet is freed, also resulting in use-after-free. PR: 255859 Submitted by: lylgood@foxmail.com Reported by: lylgood@foxmail.com (cherry picked from commit 323a4e2c4e285e6f8eee8db3fe2cb7490a734da0) --- sys/contrib/ipfilter/netinet/ip_nat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/contrib/ipfilter/netinet/ip_nat.c b/sys/contrib/ipfilter/netinet/ip_nat.c index bbf78877249c..028be649cccd 100644 --- a/sys/contrib/ipfilter/netinet/ip_nat.c +++ b/sys/contrib/ipfilter/netinet/ip_nat.c @@ -6243,7 +6243,7 @@ ipf_nat_rule_deref(softc, inp) if (n->in_tqehead[0] != NULL) { if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) { - ipf_freetimeoutqueue(softc, n->in_tqehead[1]); + ipf_freetimeoutqueue(softc, n->in_tqehead[0]); } }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202106030057.1530vq3A020161>