From: Hristo Venev <hristo@venev.name>
Date: Thu, 29 Oct 2015 10:14:44 +0000 (+0200)
Subject: network: fix use-after-free in link_free
X-Git-Tag: v228~122^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F1711%2Fhead;p=thirdparty%2Fsystemd.git

network: fix use-after-free in link_free

Freeing a link removes it both from addresses and addresses_foreign,
causing SIGSEGV if one of the sets is freed.
---

diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c
index dcc2569660c..12ca02868db 100644
--- a/src/network/networkd-link.c
+++ b/src/network/networkd-link.c
@@ -349,12 +349,12 @@ static void link_free(Link *link) {
         while (!set_isempty(link->addresses))
                 address_free(set_first(link->addresses));
 
-        set_free(link->addresses);
-
         while (!set_isempty(link->addresses_foreign))
                 address_free(set_first(link->addresses_foreign));
 
-        set_free(link->addresses_foreign);
+        link->addresses = set_free(link->addresses);
+
+        link->addresses_foreign = set_free(link->addresses_foreign);
 
         while ((address = link->pool_addresses)) {
                 LIST_REMOVE(addresses, link->pool_addresses, address);