diff options
| author |   dlg <dlg@openbsd.org> | 2019-11-14 01:02:02 +0000 |
|---|---|---|
| committer | dlg <dlg@openbsd.org> | 2019-11-14 01:02:02 +0000 |
| commit | d0f4f6723adbf04efe0ba88d574a018ed8fdc396 (patch) | |
| tree | 8a70e241e357627c77064735d9adbfe6220c5211 /lib/libcbor | |
| parent | in order to be able to figure out the number of signatures left on (diff) | |
| download | wireguard-openbsd-d0f4f6723adbf04efe0ba88d574a018ed8fdc396.tar.xz wireguard-openbsd-d0f4f6723adbf04efe0ba88d574a018ed8fdc396.zip | |
avoid a use after free in if_delgroup.
if_detach passes the groupname from an ifg_list struct to if_delgroup,
if_delgroup then uses the name to find the same ifg_list struct so
it can free it, and then passes the name from the struct to
pfi_group_change(). at worst this can cause a fault if malloc(9)
actually unmaps the page the struct was on, and at best it causes
pf interfaces with garbage names to be created.
ok sashan@ bluhm@
Diffstat (limited to 'lib/libcbor')
0 files changed, 0 insertions, 0 deletions