tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

arpresolve: inverted logic



Hi,
there appears to be a wrong logic in eco_output and token_output. arpresolve
returns a non-zero value on failure, but these functions think it returns zero.
So when arpresolve succeeds, these functions return 0 and leak the mbuf; when
arpresolve fails, these functions believe it's ok and use 'm' while it has been
freed. In short, either a memory leak or a use-after-free.

I have written a quick patch [1], which I cannot test. Could someone please
review it?

Thanks,
Maxime

[1] http://m00nbsd.net/garbage/arp/arpresolve.diff


Home | Main Index | Thread Index | Old Index