[Slirp] [Git][slirp/libslirp][master] slirp: Don't duplicate packet in tcp_reass

[Samuel Thibault (@sthibaul)]

Samuel Thibault pushed to branch master at slirp / libslirp


Commits:
e61e18f0 by Brett Nash at 2022-02-11T19:21:32+01:00
slirp: Don't duplicate packet in tcp_reass

When debug is enabled, we duplicate the packet in tcp_reass, but ti is still
pointing to the old buffer, resulting in a use after free.

This makes valgrind debugging a little trickier, but makes it
crash a lot less.

Signed-off-by: Brett Nash <nash at fb.com>

- - - - -


1 changed file:

- src/tcp_input.c


Changes:

=====================================
src/tcp_input.c
=====================================
@@ -82,9 +82,6 @@ static void tcp_xmit_timer(register struct tcpcb *tp, int rtt);
 static int tcp_reass(register struct tcpcb *tp, register struct tcpiphdr *ti,
                      struct mbuf *m)
 {
-    if (m)
-        M_DUP_DEBUG(m->slirp, m, 0, 0);
-
     register struct tcpiphdr *q;
     struct socket *so = tp->t_socket;
     int flags;



View it on GitLab: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/e61e18f0d5d7bb20eb081d0159b184a89f64eba9

-- 
View it on GitLab: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/e61e18f0d5d7bb20eb081d0159b184a89f64eba9
You're receiving this email because of your account on gitlab.freedesktop.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/slirp/attachments/20220211/baa78344/attachment.htm>