diff options
| author | Christian Grothoff <christian@grothoff.org> | 2014-12-19 21:39:11 +0000 |
|---|---|---|
| committer | Christian Grothoff <christian@grothoff.org> | 2014-12-19 21:39:11 +0000 |
| commit | cc1dfaf41624ea34094b1f2d4aab43591e2d61e7 (patch) | |
| tree | f0269ce9ad9de366e765644b9d51eb2dc62d3b80 /src/cadet | |
| parent | 511c49385f5551074f2d477d0abc0fff3794c06f (diff) | |
| download | gnunet-cc1dfaf41624ea34094b1f2d4aab43591e2d61e7.tar.gz gnunet-cc1dfaf41624ea34094b1f2d4aab43591e2d61e7.zip | |
-fix use after free (GCCH_destroy frees 'ch', and then ch->t dereferences it --- Bart, please check
Diffstat (limited to 'src/cadet')
| -rw-r--r-- | src/cadet/gnunet-service-cadet_channel.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/cadet/gnunet-service-cadet_channel.c b/src/cadet/gnunet-service-cadet_channel.c index 08ef46209..cc9cc699a 100644 --- a/src/cadet/gnunet-service-cadet_channel.c +++ b/src/cadet/gnunet-service-cadet_channel.c | |||
| @@ -1686,6 +1686,7 @@ GCCH_handle_local_ack (struct CadetChannel *ch, int fwd) | |||
| 1686 | { | 1686 | { |
| 1687 | send_destroy (ch, GNUNET_YES); | 1687 | send_destroy (ch, GNUNET_YES); |
| 1688 | GCCH_destroy (ch); | 1688 | GCCH_destroy (ch); |
| 1689 | return; | ||
| 1689 | } | 1690 | } |
| 1690 | /* if loopback is marked for destruction, no need to ACK to the other peer, | 1691 | /* if loopback is marked for destruction, no need to ACK to the other peer, |
| 1691 | * it requested the destruction and is already gone, therefore, else if. | 1692 | * it requested the destruction and is already gone, therefore, else if. |