artulab
projects / openbsd / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: b896ab8) | patch
The adjttl functions use m_pullup(). In some cases m_pullup() can return
authorclaudio <claudio@openbsd.org>
Fri, 8 Dec 2017 21:56:22 +0000 (21:56 +0000)
committerclaudio <claudio@openbsd.org>
Fri, 8 Dec 2017 21:56:22 +0000 (21:56 +0000)
commit25d240d263d10cd9492fd3851b3826d667edb794
tree05397bdcb7f200e193b93809ac134160142a238atree | snapshot
parentb896ab8b49037d751af8a8bb8c325ae7c44680e3commit | diff
The adjttl functions use m_pullup(). In some cases m_pullup() can return
a new mbuf chain and this chain needs to be returned to the caller else
a use after free may happen.
Issue reported by Maxime Villard
OK bluhm@ deraadt@
sys/netmpls/mpls_input.c diff | blob | history
OpenBSD src
by Ahmet Artu Yildirim