diff options
| author | Cy Schubert <cy@FreeBSD.org> | 2021-05-25 18:54:49 +0000 |
|---|---|---|
| committer | Cy Schubert <cy@FreeBSD.org> | 2021-06-03 00:57:45 +0000 |
| commit | c8773c8018e74a34a5d9e7ec6d66f4311148f975 (patch) | |
| tree | e6b96ba4aab9f7f1430af3eb911a34684d855fab | |
| parent | fedf63143b6ee3cdf393c2e5038edf9490a6d664 (diff) | |
| download | src-c8773c8018e74a34a5d9e7ec6d66f4311148f975.tar.gz src-c8773c8018e74a34a5d9e7ec6d66f4311148f975.zip | |
ipfilter: Fix ip_nat memory leak and use-after-free
Unfortunately the wrong elemet is freed, also resulting in use-after-free.
PR: 255859
Submitted by: lylgood@foxmail.com
Reported by: lylgood@foxmail.com
(cherry picked from commit 323a4e2c4e285e6f8eee8db3fe2cb7490a734da0)
| -rw-r--r-- | sys/contrib/ipfilter/netinet/ip_nat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/contrib/ipfilter/netinet/ip_nat.c b/sys/contrib/ipfilter/netinet/ip_nat.c index bbf78877249c..028be649cccd 100644 --- a/sys/contrib/ipfilter/netinet/ip_nat.c +++ b/sys/contrib/ipfilter/netinet/ip_nat.c @@ -6243,7 +6243,7 @@ ipf_nat_rule_deref(softc, inp) if (n->in_tqehead[0] != NULL) { if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) { - ipf_freetimeoutqueue(softc, n->in_tqehead[1]); + ipf_freetimeoutqueue(softc, n->in_tqehead[0]); } } |