diff options
| author |   Kyle Evans <kevans@FreeBSD.org> | 2022-11-03 13:20:29 -0500 |
|---|---|---|
| committer |   Jason A. Donenfeld <Jason@zx2c4.com> | 2022-11-03 19:57:26 +0100 |
| commit | 139aac59a5ab7da913d4b6dd62692fa90e2ccad4 (patch) | |
| tree | 6c7fde8e6650632f980434611fcda3d986c43190 /src/ipc-freebsd.h | |
| parent | ipc: freebsd: avoid leaking memory in kernel_get_device() (diff) | |
| download | wireguard-tools-139aac59a5ab7da913d4b6dd62692fa90e2ccad4.tar.xz wireguard-tools-139aac59a5ab7da913d4b6dd62692fa90e2ccad4.zip | |
ipc: freebsd: NULL out some freed memory in kernel_set_device()
The `err` path in kernel_set_device() will attempt to free() allocated
nvl_peers, but these two cases meant we could end up attempting a use
after free or a double free, as we rely on nvlist_destroy(NULL) being
a NOP as well as free(NULL).
FreeBSD-Coverity: 1500421
Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Diffstat (limited to '')
| -rw-r--r-- | src/ipc-freebsd.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/ipc-freebsd.h b/src/ipc-freebsd.h index b78b6c8..fa74edd 100644 --- a/src/ipc-freebsd.h +++ b/src/ipc-freebsd.h @@ -329,6 +329,7 @@ static int kernel_set_device(struct wgdevice *dev) nvlist_destroy(nvl_aips[j]); free(nvl_aips); nvlist_destroy(nvl_peers[i]); + nvl_peers[i] = NULL; goto err; } if (i) { @@ -336,9 +337,11 @@ static int kernel_set_device(struct wgdevice *dev) for (i = 0; i < peer_count; ++i) nvlist_destroy(nvl_peers[i]); free(nvl_peers); + nvl_peers = NULL; } wgd.wgd_data = nvlist_pack(nvl_device, &wgd.wgd_size); nvlist_destroy(nvl_device); + nvl_device = NULL; if (!wgd.wgd_data) goto err; s = get_dgram_socket(); |