diff options
| author | Tim van der Molen <tim@cvs.openbsd.org> | 2015-11-26 08:51:23 +0000 |
|---|---|---|
| committer | Tim van der Molen <tim@cvs.openbsd.org> | 2015-11-26 08:51:23 +0000 |
| commit | d4bdc5a860b36975c9eedb8aa2f15216e47d0e6d (patch) | |
| tree | 5798ddf5768942dc0886f00bc38df6c0cecf266c /usr.sbin | |
| parent | 2ec0aa55e96a0af3ec5e56ce1f545d7b187b8fc4 (diff) | |
Don't dereference a route and then reference it again. In this particular case,
the route would be referenced at least twice, so there is no use after free.
Prompted by a mail from David CARLIER to misc@opensmtpd.
OK eric@
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/smtpd/mta.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/usr.sbin/smtpd/mta.c b/usr.sbin/smtpd/mta.c index 24bb10d0607..538c8c63fb2 100644 --- a/usr.sbin/smtpd/mta.c +++ b/usr.sbin/smtpd/mta.c @@ -1,4 +1,4 @@ -/* $OpenBSD: mta.c,v 1.192 2015/10/14 22:01:43 gilles Exp $ */ +/* $OpenBSD: mta.c,v 1.193 2015/11/26 08:51:22 tim Exp $ */ /* * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org> @@ -1246,13 +1246,13 @@ mta_route_disable(struct mta_route *route, int penalty, int reason) log_info("smtp-out: Disabling route %s for %llus", mta_route_to_text(route), delay); - if (route->flags & ROUTE_DISABLED) { + if (route->flags & ROUTE_DISABLED) runq_cancel(runq_route, NULL, route); - mta_route_unref(route); /* from last call to here */ - } + else + mta_route_ref(route); + route->flags |= reason & ROUTE_DISABLED; runq_schedule(runq_route, time(NULL) + delay, NULL, route); - mta_route_ref(route); } static void |