artulab
projects / openbsd / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 03ed85e) | patch
Do not call nd6_purge() before purging the IPv6 addresses of a detached
authormpi <mpi@openbsd.org>
Mon, 27 Apr 2015 14:51:44 +0000 (14:51 +0000)
committermpi <mpi@openbsd.org>
Mon, 27 Apr 2015 14:51:44 +0000 (14:51 +0000)
commite520a0ec7a758fda4db3d6ff0e78ab2c0013225e
treec90c91220d9e13697709f82640ba1052a846bcedtree | snapshot
parent03ed85e124d59134107086d60805466cbd0321f3commit | diff
Do not call nd6_purge() before purging the IPv6 addresses of a detached
interface.

Fix a use after free introduced in r1.98 of netinet6/in6.c and recently
exposed by a crazy pool/malloc damage finder being currently refined by
dlg@ and deraadt@.

ok mikeb@, henning@
sys/netinet6/in6_ifattach.c diff | blob | history
sys/netinet6/nd6.c diff | blob | history
sys/netinet6/nd6_rtr.c diff | blob | history
OpenBSD src
by Ahmet Artu Yildirim