Hello,

The function ber_free_elements() sets the variable ber to NULL in most
error cases and calls ber_free_elements(ber).  This causes a NULL
dereference in ber_free_elements.  This patch fix that problem.

bye,
Jan

Index: ber.c
===================================================================
RCS file: /cvs/src/usr.sbin/snmpd/ber.c,v
retrieving revision 1.31
diff -u -p -r1.31 ber.c
--- ber.c       5 Mar 2016 03:31:36 -0000       1.31
+++ ber.c       9 May 2016 19:20:54 -0000
@@ -847,6 +847,8 @@ ber_getpos(struct ber_element *elm)
 void
 ber_free_elements(struct ber_element *root)
 {
+       if (root == NULL)
+               return;
        if (root->be_sub && (root->be_encoding == BER_TYPE_SEQUENCE ||
            root->be_encoding == BER_TYPE_SET))
                ber_free_elements(root->be_sub);

Reply via email to