From 0b076488a2005e8a848ceea102886976d5181a26 Mon Sep 17 00:00:00 2001 From: delphij Date: Sun, 25 Jun 2017 06:55:42 +0000 Subject: [PATCH] MFC r320216: Fix use-after-free introduced in r300388. In r300388, endnetconfig() was called on nc_handle which would release the associated netconfig structure, which means tmpnconf->nc_netid would be a use-after-free. Solve this by doing endnetconfig() in return paths instead. Reported by: jemalloc via kevlo Reviewed by: cem, ngie (earlier version) git-svn-id: svn://svn.freebsd.org/base/stable/9@320326 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f --- lib/libc/rpc/rpcb_clnt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/libc/rpc/rpcb_clnt.c b/lib/libc/rpc/rpcb_clnt.c index da7f014fc..46bdc0698 100644 --- a/lib/libc/rpc/rpcb_clnt.c +++ b/lib/libc/rpc/rpcb_clnt.c @@ -508,14 +508,15 @@ try_nconf: hostname = IN6_LOCALHOST_STRING; } } - endnetconfig(nc_handle); if (tmpnconf == NULL) { + endnetconfig(nc_handle); rpc_createerr.cf_stat = RPC_UNKNOWNPROTO; mutex_unlock(&loopnconf_lock); return (NULL); } loopnconf = getnetconfigent(tmpnconf->nc_netid); /* loopnconf is never freed */ + endnetconfig(nc_handle); } mutex_unlock(&loopnconf_lock); client = getclnthandle(hostname, loopnconf, NULL); -- 2.42.0