bc0ffc0e9
Thomas De Schampheleire
2013-02-28
Subject
nameif: fix use-after-free in ENABLE_FEATURE_CLEAN_UP code
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
networking/nameif.c+9 -6
| @@ -292,12 +292,11 @@ int nameif_main(int argc UNUSED_PARAM, char **argv) | |
| if (ch->mac && memcmp(ch->mac, ifr.ifr_hwaddr.sa_data, ETH_ALEN) != 0) | |
| continue; | |
| /* if we came here, all selectors have matched */ | |
| - | break; |
| + | goto found; |
| } | |
| /* Nothing found for current interface */ | |
| - | if (!ch) |
| - | continue; |
| - | |
| + | continue; |
| + | found: |
| if (strcmp(ifr.ifr_name, ch->ifname) != 0) { | |
| strcpy(ifr.ifr_newname, ch->ifname); | |
| ioctl_or_perror_and_die(ctl_sk, SIOCSIFNAME, &ifr, | |
| @@ -313,10 +312,14 @@ int nameif_main(int argc UNUSED_PARAM, char **argv) | |
| ch->next->prev = ch->prev; | |
| if (ENABLE_FEATURE_CLEAN_UP) | |
| delete_eth_table(ch); | |
| - | } |
| + | } /* while */ |
| + | |
| if (ENABLE_FEATURE_CLEAN_UP) { | |
| - | for (ch = clist; ch; ch = ch->next) |
| + | ethtable_t *next; |
| + | for (ch = clist; ch; ch = next) { |
| + | next = ch->next; |
| delete_eth_table(ch); | |
| + | } |
| config_close(parser); | |
| }; | |