From: Damien Neil <source@isc.org>
Date: Tue, 1 Aug 2000 21:54:01 +0000 (+0000)
Subject: Fix a bug in buffer_dereference where the buffer refcount was accessed
X-Git-Tag: V3-BETA-2-PATCH-1~63
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=827ae27071b0025732b6c2ec87109c1cce14cb8d;p=thirdparty%2Fdhcp.git

Fix a bug in buffer_dereference where the buffer refcount was accessed
after the buffer was deallocated.
---

diff --git a/common/alloc.c b/common/alloc.c
index d90a974ad..0b897de54 100644
--- a/common/alloc.c
+++ b/common/alloc.c
@@ -43,7 +43,7 @@
 
 #ifndef lint
 static char copyright[] =
-"$Id: alloc.c,v 1.49 2000/07/27 09:02:28 mellon Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
+"$Id: alloc.c,v 1.50 2000/08/01 21:54:01 neild Exp $ Copyright (c) 1996-2000 The Internet Software Consortium.  All rights reserved.\n";
 #endif /* not lint */
 
 #include "dhcpd.h"
@@ -691,9 +691,9 @@ int buffer_dereference (ptr, file, line)
 
 	(*ptr) -> refcnt--;
 	rc_register (file, line, ptr, *ptr, (*ptr) -> refcnt);
-	if (!(*ptr) -> refcnt)
+	if (!(*ptr) -> refcnt) {
 		dfree ((*ptr), file, line);
-	if ((*ptr) -> refcnt < 0) {
+	} else if ((*ptr) -> refcnt < 0) {
 		log_error ("%s(%d): negative refcnt!", file, line);
 #if defined (DEBUG_RC_HISTORY)
 		dump_rc_history ();