lkml.org 
[lkml]   [2015]   [Dec]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] dccp: fix use-after-free after cloning struct dccp_sock
From
From: Vegard Nossum <vegard.nossum@oracle.com>
Date: Sun, 20 Dec 2015 21:53:27 +0100

> @@ -115,6 +115,10 @@ struct sock *dccp_create_openreq_child(const struct sock *sk,
> newdp->dccps_isr = dreq->dreq_isr;
> newdp->dccps_gsr = dreq->dreq_gsr;
>
> + newdp->dccps_hc_rx_ackvec = NULL;
> + newdp->dccps_hc_rx_ccid = NULL;
> + newdp->dccps_hc_tx_ccid = NULL;

->dccps_hc_rx_ackvec is set to NULL several lines above this, so you don't
need to add that case here.

WRT the ccid pointers, I don't think we can just NULL them out.

If the parent socket has these CCID features enabled, we have to
clone them into the child somehow.


\
 
 \ /
  Last update: 2015-12-22 22:01    [W:0.046 / U:1.232 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site