]> git.ipfire.org Git - thirdparty/iproute2.git/commit
projects / thirdparty / iproute2.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a040544) | patch
ip-link: Fix use after free in nl_get_ll_addr_len()
authorPhil Sutter <phil@nwl.cc>
Thu, 1 Mar 2018 09:35:12 +0000 (10:35 +0100)
committerStephen Hemminger <stephen@networkplumber.org>
Fri, 2 Mar 2018 21:29:40 +0000 (13:29 -0800)
commit06867c371958773e39b4ccac07cfe3e2fff2ea55
treeabbf3fdb174061b9758cd578028dec1af3af7d5etree
parenta0405444f7614d9dd76cb9fb1b7a696cab5059bacommit | diff
ip-link: Fix use after free in nl_get_ll_addr_len()

Immediately after freeing the buffer returned from rtnl_talk(), it is
accessed again via pointer in struct rtattr array. This leads to some
builds not allowing to set an interface's MAC address because the
expected length value is garbage.

Fixes: 86bf43c7c2fdc ("lib/libnetlink: update rtnl_talk to support malloc buff at run time")
Signed-off-by: Phil Sutter <phil@nwl.cc>
ip/iplink.c diff | blob | blame | history
Mirror of https://git.kernel.org/pub/scm/network/iproute2/iproute2.git