From 4701725cd58bc75a287ba050c8ad69a457b68d5d Mon Sep 17 00:00:00 2001 From: Hristo Venev Date: Thu, 29 Oct 2015 12:14:44 +0200 Subject: network: fix use-after-free in link_free Freeing a link removes it both from addresses and addresses_foreign, causing SIGSEGV if one of the sets is freed. --- src/network/networkd-link.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c index dcc2569660..12ca02868d 100644 --- a/src/network/networkd-link.c +++ b/src/network/networkd-link.c @@ -349,12 +349,12 @@ static void link_free(Link *link) { while (!set_isempty(link->addresses)) address_free(set_first(link->addresses)); - set_free(link->addresses); - while (!set_isempty(link->addresses_foreign)) address_free(set_first(link->addresses_foreign)); - set_free(link->addresses_foreign); + link->addresses = set_free(link->addresses); + + link->addresses_foreign = set_free(link->addresses_foreign); while ((address = link->pool_addresses)) { LIST_REMOVE(addresses, link->pool_addresses, address); -- cgit v1.2.3-54-g00ecf