diff options
author | Michael Adam <obnox@samba.org> | 2016-10-25 13:46:18 +0200 |
---|---|---|
committer | Michael Adam <obnox@samba.org> | 2016-10-25 14:55:25 +0200 |
commit | 9ce583b6cd6f55d473e5b54794fb06450997ebc8 (patch) | |
tree | ed0e9cd58de6d5723b05b840d0688379c08ed41e /src | |
parent | ddba8cf2058d662d628fc62f5896b873754ba7c3 (diff) | |
download | socket_wrapper-9ce583b6cd6f55d473e5b54794fb06450997ebc8.tar.gz socket_wrapper-9ce583b6cd6f55d473e5b54794fb06450997ebc8.tar.xz socket_wrapper-9ce583b6cd6f55d473e5b54794fb06450997ebc8.zip |
swrap: fix use-after-free in swrap_remove_stale()
Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Diffstat (limited to 'src')
-rw-r--r-- | src/socket_wrapper.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/src/socket_wrapper.c b/src/socket_wrapper.c index 1961549..40e2f04 100644 --- a/src/socket_wrapper.c +++ b/src/socket_wrapper.c @@ -1721,17 +1721,19 @@ static void swrap_remove_stale(int fd) { struct socket_info_fd *fi = find_socket_info_fd(fd); struct socket_info *si; + int si_index; if (fi == NULL) { return; } - si = &sockets[fi->si_index]; + si_index = fi->si_index; SWRAP_LOG(SWRAP_LOG_TRACE, "remove stale wrapper for %d", fd); SWRAP_DLIST_REMOVE(socket_fds, fi); free(fi); + si = &sockets[fi->si_index]; si->refcount--; if (si->refcount > 0) { @@ -1743,7 +1745,7 @@ static void swrap_remove_stale(int fd) } si->next_free = first_free; - first_free = fi->si_index; + first_free = si_index; } static int sockaddr_convert_to_un(struct socket_info *si, |