The branch main has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=323a4e2c4e285e6f8eee8db3fe2cb7490a734da0
commit 323a4e2c4e285e6f8eee8db3fe2cb7490a734da0 Author: Cy Schubert <[email protected]> AuthorDate: 2021-05-25 18:54:49 +0000 Commit: Cy Schubert <[email protected]> CommitDate: 2021-05-25 18:58:14 +0000 ipfilter: Fix ip_nat memory leak and use-after-free Unfortunately the wrong elemet is freed, also resulting in use-after-free. PR: 255859 Submitted by: [email protected] Reported by: [email protected] MFC after: 3 days --- sys/contrib/ipfilter/netinet/ip_nat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/contrib/ipfilter/netinet/ip_nat.c b/sys/contrib/ipfilter/netinet/ip_nat.c index 41e51880b3dd..0475a4386079 100644 --- a/sys/contrib/ipfilter/netinet/ip_nat.c +++ b/sys/contrib/ipfilter/netinet/ip_nat.c @@ -6245,7 +6245,7 @@ ipf_nat_rule_deref(softc, inp) if (n->in_tqehead[0] != NULL) { if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) { - ipf_freetimeoutqueue(softc, n->in_tqehead[1]); + ipf_freetimeoutqueue(softc, n->in_tqehead[0]); } } _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/dev-commits-src-all To unsubscribe, send any mail to "[email protected]"
