[rt30024] This is a commit message

Fix a pair of memory leaks.

diff --git a/RELNOTES b/RELNOTES
index cb82c53da5439cecd06b7a0bc7a2e629ca2ba60e..05ffdbc0638549de3e8825ad387bf822532e9a6c 100644 (file)
--- a/RELNOTES
+++ b/RELNOTES
@@ -78,6 +78,12 @@ work on other platforms. Please report any problems and suggested fixes to
   [ISC-Bugs #29852]
   CVE: CVE-2012-3570
 
+! A pair of memory leaks were found and fixed.  Thanks to
+  Glen Eustace of Massey University, New Zealand for finding
+  this issue.
+  [ISC-Bugs #30024]
+  CVE: CVE-2012-3954
+
                        Changes since 4.2.4rc2
 
 - None

diff --git a/common/options.c b/common/options.c
index 8cbb03752199210495e1f6bac6b07069a9abd26b..eccaa244a6a896784da1691ffc432b0f24934af3 100644 (file)
--- a/common/options.c
+++ b/common/options.c
@@ -2403,6 +2403,8 @@ prepare_option_buffer(struct universe *universe, struct buffer *bp,
 
        /* And let go of our references. */
       cleanup:
+       if (lbp != NULL)
+               buffer_dereference(&lbp, MDL);
        option_dereference(&option, MDL);
 
        return status;

diff --git a/server/dhcpv6.c b/server/dhcpv6.c
index eb86aeb0a5ce98c66ab1f101c9a59ae48c7c2406..3ae86904f37edb57b8fad9a054b17e4864252e56 100644 (file)
--- a/server/dhcpv6.c
+++ b/server/dhcpv6.c
@@ -1519,6 +1519,8 @@ lease_to_client(struct data_string *reply_ret,
                packet_dereference(&reply.packet, MDL);
        if (reply.client_id.data != NULL)
                data_string_forget(&reply.client_id, MDL);
+       if (packet_oro.buffer != NULL)
+               data_string_forget(&packet_oro, MDL);
        reply.renew = reply.rebind = reply.prefer = reply.valid = 0;
        reply.cursor = 0;
 }