From: claudio Date: Thu, 8 Apr 2021 16:43:08 +0000 (+0000) Subject: Prevent a use-after-free access in case of a http redirect by also clearing X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=e4b9714c69e5d4eea0226e61b8ff5f168ae2b205;p=openbsd Prevent a use-after-free access in case of a http redirect by also clearing the conn->res pointer after calling freeaddrinfo(). OK tb@ (as part of a bigger diff) --- diff --git a/usr.sbin/rpki-client/http.c b/usr.sbin/rpki-client/http.c index b3d23cfcfd8..771265ec544 100644 --- a/usr.sbin/rpki-client/http.c +++ b/usr.sbin/rpki-client/http.c @@ -1,4 +1,4 @@ -/* $OpenBSD: http.c,v 1.21 2021/04/07 16:40:38 claudio Exp $ */ +/* $OpenBSD: http.c,v 1.22 2021/04/08 16:43:08 claudio Exp $ */ /* * Copyright (c) 2020 Nils Fisher * Copyright (c) 2020 Claudio Jeker @@ -526,11 +526,13 @@ http_connect(struct http_connection *conn) warn("%s: %s", http_info(conn->url), cause); freeaddrinfo(conn->res0); conn->res0 = NULL; + conn->res = NULL; return -1; } freeaddrinfo(conn->res0); conn->res0 = NULL; + conn->res = NULL; #if 0 /* TODO proxy connect */ @@ -560,6 +562,7 @@ http_finish_connect(struct http_connection *conn) freeaddrinfo(conn->res0); conn->res0 = NULL; + conn->res = NULL; #if 0 /* TODO proxy connect */