disable the SA dpd timer on sa_free(). this avoid a race

between DPD and initial contact (double free); ok hshoexer

1 files changed, 13 insertions, 1 deletions

diff --git a/sbin/isakmpd/sa.c b/sbin/isakmpd/sa.c
index 836200c64d6..d1564709c56 100644
--- a/sbin/isakmpd/sa.c
+++ b/sbin/isakmpd/sa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sa.c,v 1.88 2005/02/16 22:00:14 hshoexer Exp $	 */
+/* $OpenBSD: sa.c,v 1.89 2005/02/24 16:16:46 markus Exp $	 */
 /* $EOM: sa.c,v 1.112 2000/12/12 00:22:52 niklas Exp $	 */
 
 /*
@@ -724,6 +724,12 @@ sa_free(struct sa *sa)
 		sa->soft_death = 0;
 		sa->refcnt--;
 	}
+#if defined (USE_DPD)
+	if (sa->dpd_event) {
+		timer_remove_event(sa->dpd_event);
+		sa->dpd_event = 0;
+	}
+#endif
 	sa_remove(sa);
 }
 
@@ -1183,6 +1189,12 @@ sa_mark_replaced(struct sa *sa)
 {
 	LOG_DBG((LOG_SA, 60, "sa_mark_replaced: SA %p (%s) marked as replaced",
 	    sa, sa->name ? sa->name : "unnamed"));
+#if defined (USE_DPD)
+	if (sa->dpd_event) {
+		timer_remove_event(sa->dpd_event);
+		sa->dpd_event = 0;
+	}
+#endif
 	sa->flags |= SA_FLAG_REPLACED;
 }