upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-05-28 04:12:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix descriptor leak provoked by KKIS.05051999.003b exploit code.

Browse source 
unp_internalize() takes a reference to the descriptor.  If the send
fails after unp_internalize(), the control mbuf would be freed ophaning
the reference.

Tested in -CURRENT by: Pierre Beyssac <beyssac@enst.fr>
This commit is contained in:
Don Lewis 1999-05-10 18:09:39 +00:00
parent 38fc822d7f
commit bd508d391b
1 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
sys/kern/uipc_usrreq.c
View file

@ -31,7 +31,7 @@
* SUCH DAMAGE.
*
* From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94
* $Id: uipc_usrreq.c,v 1.42 1999/04/12 14:34:52 eivind Exp $
* $Id: uipc_usrreq.c,v 1.43 1999/04/28 11:37:07 phk Exp $
*/
#include <sys/param.h>
@ -367,6 +367,9 @@ uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
unp_shutdown(unp);
}
if (control && error != 0)
unp_dispose(control);
release:
if (control)
m_freem(control);