narenas
/
opengnsys_ipxe
mirror of https://github.com/ipxe/ipxe.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[retry] Fix potential use-after-free in timer_expired() 

timer->refcnt is allowed to be NULL, in which case the timer's
expired() method may end up freeing the timer object.

Discovered using valgrind.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
pull/5/head
Michael Brown 2011-07-16 01:46:12 +01:00
parent 5b41381f33
commit 17f09dfe03
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/net/retry.c
View File

@ -148,6 +148,7 @@ void stop_timer ( struct retry_timer *timer ) {
* @v timer Retry timer * @v timer Retry timer
*/ */
static void timer_expired ( struct retry_timer *timer ) { static void timer_expired ( struct retry_timer *timer ) {
struct refcnt *refcnt = timer->refcnt;
int fail; int fail;
/* Stop timer without performing RTT calculations */ /* Stop timer without performing RTT calculations */
@ -169,8 +170,9 @@ static void timer_expired ( struct retry_timer *timer ) {
/* Call expiry callback */ /* Call expiry callback */
timer->expired ( timer, fail ); timer->expired ( timer, fail );
/* If refcnt is NULL, then timer may already have been freed */
ref_put ( timer->refcnt ); ref_put ( refcnt );
} }
/** /**