Date: Mon, 16 May 2016 04:43:47 +0000 (UTC) From: Don Lewis <truckman@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r299894 - head/usr.sbin/ctld Message-ID: <201605160443.u4G4hlPV029103@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: truckman Date: Mon May 16 04:43:47 2016 New Revision: 299894 URL: https://svnweb.freebsd.org/changeset/base/299894 Log: pdu_delete(request) frees request, so move the call after login_new_response(request) to avoid a use-after-free error Reported by: Coverity Reviewed by: 1331219, 1331220 Modified: head/usr.sbin/ctld/login.c Modified: head/usr.sbin/ctld/login.c ============================================================================== --- head/usr.sbin/ctld/login.c Mon May 16 04:39:16 2016 (r299893) +++ head/usr.sbin/ctld/login.c Mon May 16 04:43:47 2016 (r299894) @@ -767,10 +767,10 @@ login_wait_transition(struct connection login_send_error(request, 0x02, 0x00); log_errx(1, "got no \"T\" flag after answering AuthMethod"); } - pdu_delete(request); log_debugx("got state transition request"); response = login_new_response(request); + pdu_delete(request); login_set_nsg(response, BHSLR_STAGE_OPERATIONAL_NEGOTIATION); pdu_send(response); pdu_delete(response);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201605160443.u4G4hlPV029103>