[src/trunk]: src/sys/external/bsd/ipf/netinet Free the right fragment (Cy Sch...

[christos <christos%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/172490437d9a
branches:  trunk
changeset: 823462:172490437d9a
user:      christos <christos%NetBSD.org@localhost>
date:      Sun Apr 23 19:09:29 2017 +0000

description:
Free the right fragment (Cy Schubert @ FreeBSD). This will cause use after free
issues and eventually panic.

diffstat:

 sys/external/bsd/ipf/netinet/ip_frag.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (27 lines):

diff -r f65c9632de36 -r 172490437d9a sys/external/bsd/ipf/netinet/ip_frag.c
--- a/sys/external/bsd/ipf/netinet/ip_frag.c    Sun Apr 23 18:23:32 2017 +0000
+++ b/sys/external/bsd/ipf/netinet/ip_frag.c    Sun Apr 23 19:09:29 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ip_frag.c,v 1.4 2017/01/13 15:17:00 christos Exp $     */
+/*     $NetBSD: ip_frag.c,v 1.5 2017/04/23 19:09:29 christos Exp $     */
 
 /*
  * Copyright (C) 2012 by Darren Reed.
@@ -87,7 +87,7 @@
 #if !defined(lint)
 #if defined(__NetBSD__)
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_frag.c,v 1.4 2017/01/13 15:17:00 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_frag.c,v 1.5 2017/04/23 19:09:29 christos Exp $");
 #else
 static const char sccsid[] = "@(#)ip_frag.c    1.11 3/24/96 (C) 1993-2000 Darren Reed";
 static const char rcsid[] = "@(#)Id: ip_frag.c,v 1.1.1.2 2012/07/22 13:45:17 darrenr Exp";
@@ -468,7 +468,7 @@
                          IPFR_CMPSZ)) {
                        RWLOCK_EXIT(lock);
                        FBUMPD(ifs_exists);
-                       KFREE(fra);
+                       KFREE(fran);
                        return NULL;
                }