zabpehely
/
wireguard-tools
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ipc: freebsd: NULL out some freed memory in kernel_set_device() 

The `err` path in kernel_set_device() will attempt to free() allocated
nvl_peers, but these two cases meant we could end up attempting a use
after free or a double free, as we rely on nvlist_destroy(NULL) being
a NOP as well as free(NULL).

FreeBSD-Coverity:	1500421
Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
This commit is contained in:
Kyle Evans 2022-11-03 13:20:29 -05:00 committed by Jason A. Donenfeld
parent dbf49a7d17
commit 139aac59a5
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/ipc-freebsd.h
View File

@ -329,6 +329,7 @@ static int kernel_set_device(struct wgdevice *dev)
nvlist_destroy(nvl_aips[j]); nvlist_destroy(nvl_aips[j]);
free(nvl_aips); free(nvl_aips);
nvlist_destroy(nvl_peers[i]); nvlist_destroy(nvl_peers[i]);
nvl_peers[i] = NULL;
goto err; goto err;
} }
if (i) { if (i) {
@ -336,9 +337,11 @@ static int kernel_set_device(struct wgdevice *dev)
for (i = 0; i < peer_count; ++i) for (i = 0; i < peer_count; ++i)
nvlist_destroy(nvl_peers[i]); nvlist_destroy(nvl_peers[i]);
free(nvl_peers); free(nvl_peers);
nvl_peers = NULL;
} }
wgd.wgd_data = nvlist_pack(nvl_device, &wgd.wgd_size); wgd.wgd_data = nvlist_pack(nvl_device, &wgd.wgd_size);
nvlist_destroy(nvl_device); nvlist_destroy(nvl_device);
nvl_device = NULL;
if (!wgd.wgd_data) if (!wgd.wgd_data)
goto err; goto err;
s = get_dgram_socket(); s = get_dgram_socket();