Fix memory leak in dhcpv6_add_server_cand in case odhcp6c_insert_state fails
authorBen Hutchings <ben@decadent.org.uk>
Thu, 28 Jan 2016 01:16:31 +0000 (01:16 +0000)
committerBen Hutchings <ben@decadent.org.uk>
Thu, 28 Jan 2016 13:31:29 +0000 (13:31 +0000)
If we fail to store information from the new server, the associated
NA and PD options will never be freed.  An attacker could use this
for denial-of-service.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
src/dhcpv6.c

index cfa3f29..c2a3e3d 100644 (file)
@@ -1362,6 +1362,7 @@ static void dhcpv6_handle_ia_status_code(const enum dhcpv6_msg orig,
        }
 }
 
+// Note this always takes ownership of cand->ia_na and cand->ia_pd
 static void dhcpv6_add_server_cand(const struct dhcpv6_server_cand *cand)
 {
        size_t cand_len, i;
@@ -1384,7 +1385,10 @@ static void dhcpv6_add_server_cand(const struct dhcpv6_server_cand *cand)
                        break;
        }
 
-       odhcp6c_insert_state(STATE_SERVER_CAND, i * sizeof(*c), cand, sizeof(*cand));
+       if (odhcp6c_insert_state(STATE_SERVER_CAND, i * sizeof(*c), cand, sizeof(*cand))) {
+               free(cand->ia_na);
+               free(cand->ia_pd);
+       }
 }
 
 static void dhcpv6_clear_all_server_cand(void)