File: 16-nullify-event-mapping-to-prevent-writing-over-free-d.patch

package info (click to toggle)
linux-igd 1.0%2Bcvs20070630-5
  • links: PTS
  • area: main
  • in suites: jessie, jessie-kfreebsd
  • size: 888 kB
  • ctags: 618
  • sloc: ansic: 2,066; xml: 593; sh: 136; makefile: 50
file content (24 lines) | stat: -rw-r--r-- 1,008 bytes parent folder | download | duplicates (2) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
 
Description: Nullify event->mapping to prevent writing over free'd memory
Author: Rob Leslie <rob@mars.org>
Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499827
Bug: http://sourceforge.net/p/linux-igd/bugs/6/
Forwarded: yes

Without this patch, free_expiration_event() will write to memory
free()'d by pmlist_Delete().
---
 gatedevice.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

Index: linux-igd-1.0+cvs20070630-libupnp6/gatedevice.c
===================================================================
--- linux-igd-1.0+cvs20070630-libupnp6.orig/gatedevice.c	2014-10-07 23:35:53.000000000 +0100
+++ linux-igd-1.0+cvs20070630-libupnp6/gatedevice.c	2014-10-07 23:35:54.000000000 +0100
@@ -806,6 +806,7 @@
   //will not call CancelMappingExpiration
   event->mapping->expirationEventId = -1;
   pmlist_Delete(event->mapping);
+  event->mapping = NULL;
   
   snprintf(num, sizeof(num), "%d", pmlist_Size());
   UpnpAddToPropertySet(&propSet, "PortMappingNumberOfEntries", num);