From 17f09dfe03a8c6b46d30844d3cee28266b6971fe Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Sat, 16 Jul 2011 01:46:12 +0100 Subject: [PATCH] [retry] Fix potential use-after-free in timer_expired() timer->refcnt is allowed to be NULL, in which case the timer's expired() method may end up freeing the timer object. Discovered using valgrind. Signed-off-by: Michael Brown --- src/net/retry.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/net/retry.c b/src/net/retry.c index 0aa165ab..7e20f0c8 100644 --- a/src/net/retry.c +++ b/src/net/retry.c @@ -148,6 +148,7 @@ void stop_timer ( struct retry_timer *timer ) { * @v timer Retry timer */ static void timer_expired ( struct retry_timer *timer ) { + struct refcnt *refcnt = timer->refcnt; int fail; /* Stop timer without performing RTT calculations */ @@ -169,8 +170,9 @@ static void timer_expired ( struct retry_timer *timer ) { /* Call expiry callback */ timer->expired ( timer, fail ); + /* If refcnt is NULL, then timer may already have been freed */ - ref_put ( timer->refcnt ); + ref_put ( refcnt ); } /**