CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/05/13 02:57:39
Modified files:
usr.sbin/bgpd : chash.c
Log message:
Error handling the double reallocarray in ch_table_resize() is tricky.
In case of a realloc failure for the meta tables the ch_tables arrays
was already successfully reallocated. Doing the free(tables) in the error
path results in a use-after-free scenario and instead on error ch_tables
just needs to be updated to this new table. Since the ch_level is not
adjusted the next time, reallocarray will be called on a memory block
that is already big enough which is a NOP and so this is safe.
Further cleanup will follow.
OK tb@
