sd-dhcp-server: fix possible double-free or use-after-free

diff --git a/src/libsystemd-network/sd-dhcp-server.c b/src/libsystemd-network/sd-dhcp-server.c
index fa3d3620b4058ad5266ee0743e510d6cd94b2cf0..8b9cf842a05fde6e325c786e462ed3fabe9167bb 100644 (file)
--- a/src/libsystemd-network/sd-dhcp-server.c
+++ b/src/libsystemd-network/sd-dhcp-server.c
@@ -1105,7 +1105,7 @@ int dhcp_server_handle_message(sd_dhcp_server *server, DHCPMessage *message, siz
 
                 if (server->bound_leases[pool_offset] == existing_lease) {
                         server->bound_leases[pool_offset] = NULL;
-                        hashmap_remove(server->leases_by_client_id, existing_lease);
+                        hashmap_remove(server->leases_by_client_id, &existing_lease->client_id);
                         dhcp_lease_free(existing_lease);
 
                         if (server->callback)