]> git.puffer.fish Git - mirror/frr.git/commit
pimd: fix UAF/heap corruption in BSM code 9678/head
authorDavid Lamparter <equinox@opensourcerouting.org>
Mon, 27 Sep 2021 08:33:33 +0000 (10:33 +0200)
committermergify-bot <noreply@mergify.io>
Mon, 27 Sep 2021 13:46:21 +0000 (13:46 +0000)
commitd2db4d3a45e0c1ff0ce6fe298d0828014587b5f8
tree837c68b2fcabbec388f8fd21e45dc35b26b0693d
parenta4faf46890982731e9af40cc9bd462efbda834a9
pimd: fix UAF/heap corruption in BSM code

This `XFREE()` call is in plainly in the wrong spot.  `rp_all` (the
224.0.0.0/4 entry) isn't supposed to be free'd ever, and the
conditional above makes quite clear that it remains in use.

It may be possible to exploit this as a heap corruption bug, maybe even
as RCE.  I haven't tried; I randomly noticed this while working on the
BSM code.  Luckily this code is only run by the CLI for the clear
command, so the surface is very small.

Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
(cherry picked from commit 200f56710a462354f55e6189a0d10df03415c1e4)
pimd/pim_cmd.c