diff options
author | Thomas Gschwantner <tharre3@gmail.com> | 2019-06-14 00:35:53 +0200 |
---|---|---|
committer | Thomas Gschwantner <tharre3@gmail.com> | 2019-06-14 20:14:15 +0200 |
commit | cb4f196e92f723b8378aa25b18483d922628a273 (patch) | |
tree | 41eace182b0c3b05bcecbcbc2e70b955082bdbff /radix-trie.c | |
parent | Add missing #include in netlink.h (diff) | |
download | wg-dynamic-cb4f196e92f723b8378aa25b18483d922628a273.tar.xz wg-dynamic-cb4f196e92f723b8378aa25b18483d922628a273.zip |
Fix use-after-free and memory leak in ipp_free()
Diffstat (limited to 'radix-trie.c')
-rw-r--r-- | radix-trie.c | 25 |
1 files changed, 11 insertions, 14 deletions
diff --git a/radix-trie.c b/radix-trie.c index fb39047..fbbfea2 100644 --- a/radix-trie.c +++ b/radix-trie.c @@ -288,16 +288,15 @@ static int add(struct radix_node **trie, uint8_t bits, const uint8_t *key, static void radix_free_nodes(struct radix_node *node) { - struct radix_node *old, *bottom = node; - - while (node) { - while (bottom->bit[0]) - bottom = bottom->bit[0]; - bottom->bit[0] = node->bit[1]; - - old = node; - node = node->bit[0]; - free(old); + for (struct radix_node *next; node; node = next) { + next = node->bit[0]; + if (next) { + node->bit[0] = next->bit[1]; + next->bit[1] = node; + } else { + next = node->bit[1]; + free(node); + } } } @@ -467,16 +466,14 @@ void ipp_free(struct ip_pool *pool) radix_free_nodes(pool->ip4_root); radix_free_nodes(pool->ip6_root); - for (struct radix_pool *cur = pool->ip4_pool; cur; cur = cur->next) { + for (struct radix_pool *cur = pool->ip4_pool; cur; cur = next) { next = cur->next; free(cur); - cur = next; } - for (struct radix_pool *cur = pool->ip6_pool; cur; cur = cur->next) { + for (struct radix_pool *cur = pool->ip6_pool; cur; cur = next) { next = cur->next; free(cur); - cur = next; } } |