From: Kyle Evans <kev...@freebsd.org> The `err` path in kernel_set_device() will attempt to free() allocated nvl_peers, but these two cases meant we could end up attempting a use after free or a double free, as we rely on nvlist_destroy(NULL) being a NOP as well as free(NULL).
FreeBSD-Coverity: 1500421 Signed-off-by: Kyle Evans <kev...@freebsd.org> --- src/ipc-freebsd.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/ipc-freebsd.h b/src/ipc-freebsd.h index 78064e9..f9d3550 100644 --- a/src/ipc-freebsd.h +++ b/src/ipc-freebsd.h @@ -333,6 +333,7 @@ static int kernel_set_device(struct wgdevice *dev) nvlist_destroy(nvl_aips[j]); free(nvl_aips); nvlist_destroy(nvl_peers[i]); + nvl_peers[i] = NULL; goto err; } if (i) { @@ -340,9 +341,11 @@ static int kernel_set_device(struct wgdevice *dev) for (i = 0; i < peer_count; ++i) nvlist_destroy(nvl_peers[i]); free(nvl_peers); + nvl_peers = NULL; } wgd.wgd_data = nvlist_pack(nvl_device, &wgd.wgd_size); nvlist_destroy(nvl_device); + nvl_device = NULL; if (!wgd.wgd_data) goto err; s = get_dgram_socket(); -- 2.36.1