CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/04/17 12:30:45
Modified files:
sys/net : rtsock.c
Log message:
route_output() can not use the info struct late in its function
since the rtm struct that populated it was freed around the
rtm_report() call. In that case access to info.rti_info[RTAX_DST]
is a use-after-free. Cache the address family before handling the
route message so that the route_input call can use this value instead.
Report from Bruce Dang of Calif.io
OK deraadt@
