From 3bedb11744faf9c2be24d3e0976800b30451df9a Mon Sep 17 00:00:00 2001 From: Shawn Routhier Date: Wed, 11 Jul 2012 14:50:35 -0700 Subject: [PATCH] [rt30024] This is a commit message Fix a pair of memory leaks. --- RELNOTES | 6 ++++++ common/options.c | 2 ++ server/dhcpv6.c | 2 ++ 3 files changed, 10 insertions(+) diff --git a/RELNOTES b/RELNOTES index 53cddaffe..b5c9134f8 100644 --- a/RELNOTES +++ b/RELNOTES @@ -97,6 +97,12 @@ work on other platforms. Please report any problems and suggested fixes to [ISC-Bugs #29852] CVE: CVE-2012-3570 +! A pair of memory leaks were found and fixed. Thanks to + Glen Eustace of Massey University, New Zealand for finding + this issue. + [ISC-Bugs #30024] + CVE: TBD + Changes since 4.2.3 ! Add a check for a null pointer before calling the regexec function. diff --git a/common/options.c b/common/options.c index 56d2e88ea..f3a3db07d 100644 --- a/common/options.c +++ b/common/options.c @@ -2403,6 +2403,8 @@ prepare_option_buffer(struct universe *universe, struct buffer *bp, /* And let go of our references. */ cleanup: + if (lbp != NULL) + buffer_dereference(&lbp, MDL); option_dereference(&option, MDL); return status; diff --git a/server/dhcpv6.c b/server/dhcpv6.c index d763c954e..aa22e6916 100644 --- a/server/dhcpv6.c +++ b/server/dhcpv6.c @@ -1519,6 +1519,8 @@ lease_to_client(struct data_string *reply_ret, packet_dereference(&reply.packet, MDL); if (reply.client_id.data != NULL) data_string_forget(&reply.client_id, MDL); + if (packet_oro.buffer != NULL) + data_string_forget(&packet_oro, MDL); reply.renew = reply.rebind = reply.prefer = reply.valid = 0; reply.cursor = 0; } -- 2.47.2