tree 59bb752a81ef735516ad8e71b2b5a4edb4e20481
parent 28c1dde9aa2a22724f81134035959d1a33a57690
author Michael Roth <mdroth@linux.vnet.ibm.com> 1569345487 -0500
committer Michael Roth <mdroth@linux.vnet.ibm.com> 1569967256 -0500

slrip: ip_reass: Fix use after free

Using ip_deq after m_free might read pointers from an allocation reuse.

This would be difficult to exploit, but that is still related with
CVE-2019-14378 which generates fragmented IP packets that would trigger this
issue and at least produce a DoS.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
(from libslirp.git commit c59279437eda91841b9d26079c70b8a540d41204)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>