aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorMichael Adam <obnox@samba.org>2016-10-25 13:46:18 +0200
committerMichael Adam <obnox@samba.org>2016-10-25 14:55:25 +0200
commit9ce583b6cd6f55d473e5b54794fb06450997ebc8 (patch)
treeed0e9cd58de6d5723b05b840d0688379c08ed41e /src
parentddba8cf2058d662d628fc62f5896b873754ba7c3 (diff)
downloadsocket_wrapper-9ce583b6cd6f55d473e5b54794fb06450997ebc8.tar.gz
socket_wrapper-9ce583b6cd6f55d473e5b54794fb06450997ebc8.tar.xz
socket_wrapper-9ce583b6cd6f55d473e5b54794fb06450997ebc8.zip
swrap: fix use-after-free in swrap_remove_stale()
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
Diffstat (limited to 'src')
-rw-r--r--src/socket_wrapper.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/src/socket_wrapper.c b/src/socket_wrapper.c
index 1961549..40e2f04 100644
--- a/src/socket_wrapper.c
+++ b/src/socket_wrapper.c
@@ -1721,17 +1721,19 @@ static void swrap_remove_stale(int fd)
{
struct socket_info_fd *fi = find_socket_info_fd(fd);
struct socket_info *si;
+ int si_index;
if (fi == NULL) {
return;
}
- si = &sockets[fi->si_index];
+ si_index = fi->si_index;
SWRAP_LOG(SWRAP_LOG_TRACE, "remove stale wrapper for %d", fd);
SWRAP_DLIST_REMOVE(socket_fds, fi);
free(fi);
+ si = &sockets[fi->si_index];
si->refcount--;
if (si->refcount > 0) {
@@ -1743,7 +1745,7 @@ static void swrap_remove_stale(int fd)
}
si->next_free = first_free;
- first_free = fi->si_index;
+ first_free = si_index;
}
static int sockaddr_convert_to_un(struct socket_info *si,