From: Phil Sutter <phil@nwl.cc>
Date: Thu, 1 Mar 2018 09:35:12 +0000 (+0100)
Subject: ip-link: Fix use after free in nl_get_ll_addr_len()
X-Git-Tag: v4.16.0~37
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=06867c371958773e39b4ccac07cfe3e2fff2ea55;p=thirdparty%2Fiproute2.git

ip-link: Fix use after free in nl_get_ll_addr_len()

Immediately after freeing the buffer returned from rtnl_talk(), it is
accessed again via pointer in struct rtattr array. This leads to some
builds not allowing to set an interface's MAC address because the
expected length value is garbage.

Fixes: 86bf43c7c2fdc ("lib/libnetlink: update rtnl_talk to support malloc buff at run time")
Signed-off-by: Phil Sutter <phil@nwl.cc>
---

diff --git a/ip/iplink.c b/ip/iplink.c
index 230f4c537..d401311bc 100644
--- a/ip/iplink.c
+++ b/ip/iplink.c
@@ -276,8 +276,9 @@ static int nl_get_ll_addr_len(unsigned int dev_index)
 		return -1;
 	}
 
+	len = RTA_PAYLOAD(tb[IFLA_ADDRESS]);
 	free(answer);
-	return RTA_PAYLOAD(tb[IFLA_ADDRESS]);
+	return len;
 }
 
 static void iplink_parse_vf_vlan_info(int vf, int *argcp, char ***argvp,