fork of 9front i guess
Go to file
cinap_lenrek 7314601f9d pppoe: Avoid double free (thanks k0ga)
k0ga reports:

Hello,

While I was setting my pppoe conexion with my ISP
I discovered several problems in ip/pppoe. I used
the command line ip/pppoe -A '' ether0 and I got
this:

...
dropping unwanted pkt: wrong ac name
panic: D2B called on non-block dc10 (double-free?)
note rcved: sys: trap: fault read addr=0x0 pc=0x000066e1
pppoe 1013: suicide: sys: trap: fault read addr=0x0 pc=0x000066e1
cpu% acid 1013
/proc/1013/text:386 plan 9 executable
/sys/lib/acid/port
/sys/lib/acid/386
acid: stk()
abort()+0x0 /sys/src/libc/9sys/abort.c:6
ppanic(p=0xd1b8,fmt=0xc7f9)+0x146 /sys/src/libc/port/malloc.c:166
D2B(p=0xd1b8,v=0xdc10)+0x57 /sys/src/libc/port/pool.c:926
poolfreel(v=0xdc10,p=0xd1b8)+0x20 /sys/src/libc/port/pool.c:1152
poolfree(p=0xd1b8,v=0xdc10)+0x3b /sys/src/libc/port/pool.c:1287
free(v=0xdc18)+0x23 /sys/src/libc/port/malloc.c:250
clearstate()+0x1b /sys/src/cmd/ip/pppoe.c:328
pppoe(ether=0xdfffefc1)+0x123 /sys/src/cmd/ip/pppoe.c:426
main(argv=0xdfffefa0,argc=0x1)+0x89 /sys/src/cmd/ip/pppoe.c:100
_main+0x31 /sys/src/libc/386/main9.s:16
acid:


clearstate() is called in pppoe.c:424, and it frees acname and sets it
to nil.  pktread() is called in pppoe.c:434 with parameter wantoffer,
which frees acname again in line pppoe.c:360 but doesn't set it to
nil, so clearstate() makes a double free in the next iteration.
2016-03-01 23:54:37 +01:00
386 introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
68000 introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
68020 introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
acme acme/win: fix mistake 2014-12-12 21:18:31 +01:00
adm/timezone add Uruguay timezone (from sources) 2013-01-25 14:13:01 +01:00
alpha introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
amd64 introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
arm introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
lib fix /lib/keyboard spacing 2016-03-01 17:30:42 -05:00
mips introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
power introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
power64 introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
rc rcpu: post hangup note to remote when connection breaks 2016-02-27 02:08:00 +01:00
sparc introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
sparc64 introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
spim introduce signed intptr and %z format modifier for formating uintptr and intptr 2016-01-07 04:39:09 +01:00
sys pppoe: Avoid double free (thanks k0ga) 2016-03-01 23:54:37 +01:00
.hgignore fix library mkfiles for objtype=spim 2015-08-08 08:04:41 +02:00