Re: Brainy: UAF in iscsi_ioctl.c

[Maxime Villard <max%m00nbsd.net@localhost>]

Le 19/09/2015 20:33, David Holland a écrit :
> On Sat, Sep 19, 2015 at 04:18:38PM +0200, Maxime Villard wrote:
>  > Hi,
>  > in sys/dev/iscsi/iscsi_ioctl.c:
>  > 
>  > 1542		free(sess, M_DEVBUF);
>  > 1543
>  > 1544		DEB(1, ("Cleanup: session ended %d\n", sess->id));
>  > 
>  > I guess inverting the two instructions fixes the bug.
>  > 
>  > Found by Brainy.
> 
> Fixed, but you can commit ones like this yourself you know :-)
> 

I told myself that there may be other underlying issues in here, and I was
too busy/lazy to make sure it wasn't the case.

> 
> But then you would miss out on the Found by Brainy advertisements! ;)
> 

It is true that, now that I've given a glance at MARC.info, I figure out
almost all my mails have a "brainy" somewhere. But I don't think I should
feel sorry about finding bugs.

Maxime