tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: arpresolve: inverted logic



In article <005b4467-9b1b-d95c-1714-60a2c22d9777%m00nbsd.net@localhost>,
Maxime Villard  <max%m00nbsd.net@localhost> wrote:
>Hi,
>there appears to be a wrong logic in eco_output and token_output. arpresolve
>returns a non-zero value on failure, but these functions think it returns zero.
>So when arpresolve succeeds, these functions return 0 and leak the mbuf; when
>arpresolve fails, these functions believe it's ok and use 'm' while it has been
>freed. In short, either a memory leak or a use-after-free.
>
>I have written a quick patch [1], which I cannot test. Could someone please
>review it?
>
>Thanks,
>Maxime
>
>[1] http://m00nbsd.net/garbage/arp/arpresolve.diff

LGTM

christos



Home | Main Index | Thread Index | Old Index