aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCy Schubert <cy@FreeBSD.org>2021-05-25 18:54:49 +0000
committerCy Schubert <cy@FreeBSD.org>2021-06-03 00:54:30 +0000
commit2fb377976493cd961dfe1908d1c565742e79bb4a (patch)
tree83e0950c89b1fc965ed6061140fa4d7c2657ffd3
parent19cfc8e65587e5a619e425a062e4aa69cdcf1eaf (diff)
downloadsrc-2fb377976493cd961dfe1908d1c565742e79bb4a.tar.gz
src-2fb377976493cd961dfe1908d1c565742e79bb4a.zip
ipfilter: Fix ip_nat memory leak and use-after-free
Unfortunately the wrong elemet is freed, also resulting in use-after-free. PR: 255859 Submitted by: lylgood@foxmail.com Reported by: lylgood@foxmail.com (cherry picked from commit 323a4e2c4e285e6f8eee8db3fe2cb7490a734da0)
-rw-r--r--sys/contrib/ipfilter/netinet/ip_nat.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/contrib/ipfilter/netinet/ip_nat.c b/sys/contrib/ipfilter/netinet/ip_nat.c
index 084c79bbee9a..6b48543d6119 100644
--- a/sys/contrib/ipfilter/netinet/ip_nat.c
+++ b/sys/contrib/ipfilter/netinet/ip_nat.c
@@ -6243,7 +6243,7 @@ ipf_nat_rule_deref(softc, inp)
if (n->in_tqehead[0] != NULL) {
if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
- ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
+ ipf_freetimeoutqueue(softc, n->in_tqehead[0]);
}
}