aboutsummaryrefslogtreecommitdiffstats
path: root/src/plugins/sctp
diff options
context:
space:
mode:
authorBenoît Ganne <bganne@cisco.com>2019-07-18 18:38:42 +0200
committerFlorin Coras <florin.coras@gmail.com>2019-10-01 21:57:09 +0000
commitd4aeb84c3f066b755b723163da292eab95bd1ef9 (patch)
tree0be8fb435d76665377cb1248271c8df78d309b10 /src/plugins/sctp
parentb5a2f7056967630c2834b0b4bf03520d96806c3e (diff)
session: fix use-after-free
Make sure to reinitialize data before free-ing it. Type: fix Change-Id: I45727c456d0345204d4825ecdd9690c5ebeb5e94 Signed-off-by: Benoît Ganne <bganne@cisco.com>
Diffstat (limited to 'src/plugins/sctp')
-rw-r--r--src/plugins/sctp/sctp.h4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/plugins/sctp/sctp.h b/src/plugins/sctp/sctp.h
index a99b01c1c0a..aa2409ecce8 100644
--- a/src/plugins/sctp/sctp.h
+++ b/src/plugins/sctp/sctp.h
@@ -607,11 +607,11 @@ always_inline void
sctp_half_open_connection_del (sctp_connection_t * tc)
{
sctp_main_t *sctp_main = vnet_get_sctp_main ();
+ u32 index = tc->sub_conn[SCTP_PRIMARY_PATH_IDX].c_c_index;
clib_spinlock_lock_if_init (&sctp_main->half_open_lock);
- pool_put_index (sctp_main->half_open_connections,
- tc->sub_conn[SCTP_PRIMARY_PATH_IDX].c_c_index);
if (CLIB_DEBUG)
clib_memset (tc, 0xFA, sizeof (*tc));
+ pool_put_index (sctp_main->half_open_connections, index);
clib_spinlock_unlock_if_init (&sctp_main->half_open_lock);
}