summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNick Mathewson <nickm@torproject.org>2016-12-07 10:52:12 -0500
committerNick Mathewson <nickm@torproject.org>2016-12-07 10:52:12 -0500
commitd6ca36defa25e0d77718731924195cc244a18b11 (patch)
treee21612be111aeba9c589857f881e4ccb8bbcfdf4
parent30f05167f1b1dd26427a80db6494842f40049cb7 (diff)
parent045a50e45a74b9e403a320e4d3590a8eb0793d09 (diff)
downloadtor-d6ca36defa25e0d77718731924195cc244a18b11.tar.gz
tor-d6ca36defa25e0d77718731924195cc244a18b11.zip
Merge branch 'bug20710_025' into maint-0.2.9
-rw-r--r--changes/bug20710_0254
-rw-r--r--src/common/sandbox.c5
2 files changed, 7 insertions, 2 deletions
diff --git a/changes/bug20710_025 b/changes/bug20710_025
new file mode 100644
index 0000000000..12bd07536c
--- /dev/null
+++ b/changes/bug20710_025
@@ -0,0 +1,4 @@
+ o Minor bugfixes (memory leak, use-after-free, linux seccomp2 sandbox):
+ - Fix a memory leak and use-after-free error when removing entries
+ from the sandbox's getaddrinfo() cache. Fixes bug 20710; bugfix on
+ 0.2.5.5-alpha. Patch from "cypherpunks".
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index 24ba8a2997..ebc843e130 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -1579,13 +1579,14 @@ sandbox_add_addrinfo(const char *name)
void
sandbox_free_getaddrinfo_cache(void)
{
- cached_getaddrinfo_item_t **next, **item;
+ cached_getaddrinfo_item_t **next, **item, *this;
for (item = HT_START(getaddrinfo_cache, &getaddrinfo_cache);
item;
item = next) {
+ this = *item;
next = HT_NEXT_RMV(getaddrinfo_cache, &getaddrinfo_cache, item);
- cached_getaddrinfo_item_free(*item);
+ cached_getaddrinfo_item_free(this);
}
HT_CLEAR(getaddrinfo_cache, &getaddrinfo_cache);