diff options
| author | Ben Hutchings <ben@decadent.org.uk> | 2016-01-28 01:16:31 +0000 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2016-01-28 13:31:29 +0000 |
| commit | b0d1c5805a6b76c3b198728cdfd93e351d5eb196 (patch) | |
| tree | ff9f4cc61368dd9b6671a94c83a0d9f7ba5a56ca /src | |
| parent | 7b22e48fbf23d20d92a4bae581f39ac3704d8bb2 (diff) | |
| download | odhcp6c-b0d1c5805a6b76c3b198728cdfd93e351d5eb196.tar.gz | |
Fix memory leak in dhcpv6_add_server_cand in case odhcp6c_insert_state fails
If we fail to store information from the new server, the associated
NA and PD options will never be freed. An attacker could use this
for denial-of-service.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'src')
| -rw-r--r-- | src/dhcpv6.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/dhcpv6.c b/src/dhcpv6.c index cfa3f29..c2a3e3d 100644 --- a/src/dhcpv6.c +++ b/src/dhcpv6.c @@ -1362,6 +1362,7 @@ static void dhcpv6_handle_ia_status_code(const enum dhcpv6_msg orig, } } +// Note this always takes ownership of cand->ia_na and cand->ia_pd static void dhcpv6_add_server_cand(const struct dhcpv6_server_cand *cand) { size_t cand_len, i; @@ -1384,7 +1385,10 @@ static void dhcpv6_add_server_cand(const struct dhcpv6_server_cand *cand) break; } - odhcp6c_insert_state(STATE_SERVER_CAND, i * sizeof(*c), cand, sizeof(*cand)); + if (odhcp6c_insert_state(STATE_SERVER_CAND, i * sizeof(*c), cand, sizeof(*cand))) { + free(cand->ia_na); + free(cand->ia_pd); + } } static void dhcpv6_clear_all_server_cand(void) |