ip: reassembly: fix one possible use-after-free 01/26701/5
authorGao Feng <davidfgao@tencent.com>
Sun, 26 Apr 2020 01:57:18 +0000 (09:57 +0800)
committerOle Trøan <otroan@employees.org>
Mon, 27 Apr 2020 13:35:17 +0000 (13:35 +0000)
commit9165e0365cc21575fd3e4a98be59317a839553f4
tree8d6a3903e2fd0f275bf73734b262ab4bc9a2cdaf
parentffbcf6178891bd68a97543ac91d28f37256d5e13
ip: reassembly: fix one possible use-after-free

When use the kv->v.memory_owner_thread_index as the index to get the
reass in pool, maybe this element is freed by the owner thread because
of timeout, too many fragments, and so on.

So we should check if do_handoff with kv->v.memory_owner_thread_index
before get the reass from pool.

Type: fix

Signed-off-by: Gao Feng <davidfgao@tencent.com>
Change-Id: Ie0f1dc368f86d0fd65292ca0c5e1908348015e09
src/vnet/ip/reass/ip4_full_reass.c
src/vnet/ip/reass/ip6_full_reass.c