mirror of
https://github.com/opnsense/src.git
synced 2026-03-19 09:13:43 -04:00
1463d5ff13
m_unshare() can return a new mbuf pointer. We update the 'm' pointer in ovpn_udp_input(), but if we decide to pass on the packet (e.g. because it's for an unknown peer) the caller (udp_append()) continues with the old 'm' pointer, eventually resulting in a use-after-free. Re-order operations in ovpn_udp_input() so that we don't modify the 'm' pointer until we're committed to keeping the packet. PR: 283426 Test case by: takahiro.kurosawa@gmail.com MFC after: 2 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit 04a7134c1e92c7752ffdc665f99ae26db70866c0) |
||
|---|---|---|
| .. | ||
| if_ovpn | ||
| routing | ||
| dhclient_pcp.conf | ||
| if_bridge_test.sh | ||
| if_clone_test.sh | ||
| if_epair.c | ||
| if_epair_test.sh | ||
| if_gif.sh | ||
| if_lagg_test.sh | ||
| if_stf.sh | ||
| if_tun_test.sh | ||
| if_vlan.sh | ||
| if_wg.sh | ||
| Makefile | ||
| pcp.py | ||
| randsleep.c | ||
| stp.py | ||