ipc: freebsd: NULL out some freed memory in kernel_set_device()

The `err` path in kernel_set_device() will attempt to free() allocated
nvl_peers, but these two cases meant we could end up attempting a use
after free or a double free, as we rely on nvlist_destroy(NULL) being
a NOP as well as free(NULL).

FreeBSD-Coverity:	1500421
Signed-off-by: Kyle Evans <kevans@FreeBSD.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>

diff --git a/src/ipc-freebsd.h b/src/ipc-freebsd.h
index b78b6c8960cd6aac8cb951790edb0a455b3f0187..fa74edda5a3d4392e29de4c50289fa6c798b6ab1 100644 (file)
--- a/src/ipc-freebsd.h
+++ b/src/ipc-freebsd.h
@@ -329,6 +329,7 @@ static int kernel_set_device(struct wgdevice *dev)
                        nvlist_destroy(nvl_aips[j]);
                free(nvl_aips);
                nvlist_destroy(nvl_peers[i]);
+               nvl_peers[i] = NULL;
                goto err;
        }
        if (i) {
@@ -336,9 +337,11 @@ static int kernel_set_device(struct wgdevice *dev)
                for (i = 0; i < peer_count; ++i)
                        nvlist_destroy(nvl_peers[i]);
                free(nvl_peers);
+               nvl_peers = NULL;
        }
        wgd.wgd_data = nvlist_pack(nvl_device, &wgd.wgd_size);
        nvlist_destroy(nvl_device);
+       nvl_device = NULL;
        if (!wgd.wgd_data)
                goto err;
        s = get_dgram_socket();