diff options
| author | Claudio Jeker <claudio@cvs.openbsd.org> | 2009-02-25 17:09:56 +0000 |
|---|---|---|
| committer | Claudio Jeker <claudio@cvs.openbsd.org> | 2009-02-25 17:09:56 +0000 |
| commit | 04be85b2d4ff2fa7648abd57f75508dc582f13e9 (patch) | |
| tree | 528c57da548498cdf0d836792ae0a8104a55545b /usr.sbin | |
| parent | b31a8aca88f7587c56c5d91a933889cfcd19ff2f (diff) | |
Fix an invalid pointer dereference in control_close(). If control_connbyfd()
fails -- which should never happen -- the function does not return and is
accession the NULL set control pointer later on.
Found by Matthew Haub. OK deraadt@
Diffstat (limited to 'usr.sbin')
| -rw-r--r-- | usr.sbin/dvmrpd/control.c | 6 | ||||
| -rw-r--r-- | usr.sbin/ospf6d/control.c | 6 | ||||
| -rw-r--r-- | usr.sbin/ospfd/control.c | 6 | ||||
| -rw-r--r-- | usr.sbin/relayd/control.c | 6 | ||||
| -rw-r--r-- | usr.sbin/ripd/control.c | 6 | ||||
| -rw-r--r-- | usr.sbin/snmpd/control.c | 6 |
6 files changed, 24 insertions, 12 deletions
diff --git a/usr.sbin/dvmrpd/control.c b/usr.sbin/dvmrpd/control.c index 6483abc735f..f078914ec6c 100644 --- a/usr.sbin/dvmrpd/control.c +++ b/usr.sbin/dvmrpd/control.c @@ -1,4 +1,4 @@ -/* $OpenBSD: control.c,v 1.4 2008/01/31 12:17:35 henning Exp $ */ +/* $OpenBSD: control.c,v 1.5 2009/02/25 17:09:55 claudio Exp $ */ /* * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> @@ -171,8 +171,10 @@ control_close(int fd) { struct ctl_conn *c; - if ((c = control_connbyfd(fd)) == NULL) + if ((c = control_connbyfd(fd)) == NULL) { log_warn("control_close: fd %d: not found", fd); + return; + } msgbuf_clear(&c->ibuf.w); TAILQ_REMOVE(&ctl_conns, c, entry); diff --git a/usr.sbin/ospf6d/control.c b/usr.sbin/ospf6d/control.c index f1c2fd76d14..e9e61206eba 100644 --- a/usr.sbin/ospf6d/control.c +++ b/usr.sbin/ospf6d/control.c @@ -1,4 +1,4 @@ -/* $OpenBSD: control.c,v 1.6 2009/01/28 22:47:36 stsp Exp $ */ +/* $OpenBSD: control.c,v 1.7 2009/02/25 17:09:55 claudio Exp $ */ /* * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> @@ -169,8 +169,10 @@ control_close(int fd) { struct ctl_conn *c; - if ((c = control_connbyfd(fd)) == NULL) + if ((c = control_connbyfd(fd)) == NULL) { log_warn("control_close: fd %d: not found", fd); + return; + } msgbuf_clear(&c->ibuf.w); TAILQ_REMOVE(&ctl_conns, c, entry); diff --git a/usr.sbin/ospfd/control.c b/usr.sbin/ospfd/control.c index 20b3b8dd2d8..f3e0d1665e1 100644 --- a/usr.sbin/ospfd/control.c +++ b/usr.sbin/ospfd/control.c @@ -1,4 +1,4 @@ -/* $OpenBSD: control.c,v 1.21 2008/11/21 11:14:42 claudio Exp $ */ +/* $OpenBSD: control.c,v 1.22 2009/02/25 17:09:55 claudio Exp $ */ /* * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> @@ -171,8 +171,10 @@ control_close(int fd) { struct ctl_conn *c; - if ((c = control_connbyfd(fd)) == NULL) + if ((c = control_connbyfd(fd)) == NULL) { log_warn("control_close: fd %d: not found", fd); + return; + } msgbuf_clear(&c->ibuf.w); TAILQ_REMOVE(&ctl_conns, c, entry); diff --git a/usr.sbin/relayd/control.c b/usr.sbin/relayd/control.c index 67be0a1a7be..7a7e5d5cba1 100644 --- a/usr.sbin/relayd/control.c +++ b/usr.sbin/relayd/control.c @@ -1,4 +1,4 @@ -/* $OpenBSD: control.c,v 1.26 2008/07/19 10:52:32 reyk Exp $ */ +/* $OpenBSD: control.c,v 1.27 2009/02/25 17:09:55 claudio Exp $ */ /* * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> @@ -173,8 +173,10 @@ control_close(int fd) { struct ctl_conn *c; - if ((c = control_connbyfd(fd)) == NULL) + if ((c = control_connbyfd(fd)) == NULL) { log_warn("control_close: fd %d: not found", fd); + return; + } msgbuf_clear(&c->ibuf.w); TAILQ_REMOVE(&ctl_conns, c, entry); diff --git a/usr.sbin/ripd/control.c b/usr.sbin/ripd/control.c index 78a0b81380b..9cee5dec02e 100644 --- a/usr.sbin/ripd/control.c +++ b/usr.sbin/ripd/control.c @@ -1,4 +1,4 @@ -/* $OpenBSD: control.c,v 1.6 2008/01/31 12:17:35 henning Exp $ */ +/* $OpenBSD: control.c,v 1.7 2009/02/25 17:09:55 claudio Exp $ */ /* * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> @@ -170,8 +170,10 @@ control_close(int fd) { struct ctl_conn *c; - if ((c = control_connbyfd(fd)) == NULL) + if ((c = control_connbyfd(fd)) == NULL) { log_warn("control_close: fd %d: not found", fd); + return; + } msgbuf_clear(&c->ibuf.w); TAILQ_REMOVE(&ctl_conns, c, entry); diff --git a/usr.sbin/snmpd/control.c b/usr.sbin/snmpd/control.c index bde9dd16ef9..a8f3a08c612 100644 --- a/usr.sbin/snmpd/control.c +++ b/usr.sbin/snmpd/control.c @@ -1,4 +1,4 @@ -/* $OpenBSD: control.c,v 1.8 2008/09/26 15:19:55 reyk Exp $ */ +/* $OpenBSD: control.c,v 1.9 2009/02/25 17:09:55 claudio Exp $ */ /* * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org> @@ -180,8 +180,10 @@ control_close(int fd) { struct ctl_conn *c; - if ((c = control_connbyfd(fd)) == NULL) + if ((c = control_connbyfd(fd)) == NULL) { log_warn("control_close: fd %d: not found", fd); + return; + } msgbuf_clear(&c->ibuf.w); TAILQ_REMOVE(&ctl_conns, c, entry); |