mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-16 10:20:30 +00:00
Code Issues Releases Activity

Fix descriptor leak provoked by KKIS.05051999.003b exploit code.

Browse Source 
unp_internalize() takes a reference to the descriptor.  If the send
fails after unp_internalize(), the control mbuf would be freed ophaning
the reference.

Tested in -CURRENT by: Pierre Beyssac <beyssac@enst.fr>
This commit is contained in:
Don Lewis 1999-05-10 18:09:39 +00:00
parent 38fc822d7f
commit bd508d391b
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=46919
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
sys/kern/uipc_usrreq.c
View File

@ -31,7 +31,7 @@
* SUCH DAMAGE.
*
* From: @(#)uipc_usrreq.c 8.3 (Berkeley) 1/4/94
* $Id: uipc_usrreq.c,v 1.42 1999/04/12 14:34:52 eivind Exp $
* $Id: uipc_usrreq.c,v 1.43 1999/04/28 11:37:07 phk Exp $
*/
#include <sys/param.h>
@ -367,6 +367,9 @@ uipc_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
unp_shutdown(unp);
}
if (control && error != 0)
unp_dispose(control);
release:
if (control)
m_freem(control);