diff options
| author | Martin Pieuchot <mpi@cvs.openbsd.org> | 2015-09-04 08:17:07 +0000 |
|---|---|---|
| committer | Martin Pieuchot <mpi@cvs.openbsd.org> | 2015-09-04 08:17:07 +0000 |
| commit | 3037ff4bd045e21646d5c0a5486dc6c3f13a1cb1 (patch) | |
| tree | ca91b36bb60c7fe6dcbff29660d4c6fdc373eb21 /sys/net | |
| parent | 58b90e485aa57244dbdd5e8994f100d865b03ba1 (diff) | |
Fix an mbuf use-after-fruit in pflow_clone_create().
Issue reported by semarie@ on bugs@ who also isolated the
use-after-fruit to pflow(4) using dlg@'s tracing mbuf diff.
Inputs from and ok florian@, semarie@, benno@
Diffstat (limited to 'sys/net')
| -rw-r--r-- | sys/net/if_pflow.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/net/if_pflow.c b/sys/net/if_pflow.c index 787f9897b3d..8946ea187e8 100644 --- a/sys/net/if_pflow.c +++ b/sys/net/if_pflow.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_pflow.c,v 1.55 2015/07/21 03:03:10 florian Exp $ */ +/* $OpenBSD: if_pflow.c,v 1.56 2015/09/04 08:17:06 mpi Exp $ */ /* * Copyright (c) 2011 Florian Obser <florian@narrans.de> @@ -151,7 +151,7 @@ pflow_clone_create(struct if_clone *ifc, int unit) MGET(pflowif->send_nam, M_WAIT, MT_SONAME); sin = mtod(pflowif->send_nam, struct sockaddr_in *); memset(sin, 0 , sizeof(*sin)); - sin->sin_len = m->m_len = sizeof (struct sockaddr_in); + sin->sin_len = pflowif->send_nam->m_len = sizeof (struct sockaddr_in); sin->sin_family = AF_INET; sin->sin_addr.s_addr = INADDR_ANY; sin->sin_port = 0; |