diff options
| author | David Lamparter <equinox@opensourcerouting.org> | 2021-09-27 10:33:33 +0200 |
|---|---|---|
| committer | David Lamparter <equinox@opensourcerouting.org> | 2021-09-27 10:37:23 +0200 |
| commit | 200f56710a462354f55e6189a0d10df03415c1e4 (patch) | |
| tree | 0406b1acf12b0d6a38b1b14a1044e9d7d976405f /zebra/interface.c | |
| parent | 83caa5e5c1e05062977bdd77ede06d63d03c1ddf (diff) | |
pimd: fix UAF/heap corruption in BSM code
This `XFREE()` call is in plainly in the wrong spot. `rp_all` (the
224.0.0.0/4 entry) isn't supposed to be free'd ever, and the
conditional above makes quite clear that it remains in use.
It may be possible to exploit this as a heap corruption bug, maybe even
as RCE. I haven't tried; I randomly noticed this while working on the
BSM code. Luckily this code is only run by the CLI for the clear
command, so the surface is very small.
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
Diffstat (limited to 'zebra/interface.c')
0 files changed, 0 insertions, 0 deletions