diff options
author | Ethan Jackson <ethan@nicira.com> | 2012-06-07 13:05:41 -0700 |
---|---|---|
committer | Ethan Jackson <ethan@nicira.com> | 2012-06-07 13:25:19 -0700 |
commit | 47d6db10fceaa95e8d69885175ad188b501d3535 (patch) | |
tree | 157fedd710bad77dd6009b3687360cc9594e7b1f | |
parent | 6cdbf522946a2ca7a1870c44eb4959cf4360f0ba (diff) |
ofproto: Fix use after free in ofoperation_complete().
In one edge case, ofoperation_complete() destroys its rule, without
updating its ofoperation that the rule is gone. Later in the same
function, ofoperation_destroy() attempts to modify the rule which
already destroyed.
Bug #11797.
Signed-off-by: Ethan Jackson <ethan@nicira.com>
-rw-r--r-- | ofproto/ofproto.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/ofproto/ofproto.c b/ofproto/ofproto.c index 0a91dc4b..52818de8 100644 --- a/ofproto/ofproto.c +++ b/ofproto/ofproto.c @@ -3528,6 +3528,7 @@ ofoperation_complete(struct ofoperation *op, enum ofperr error) } else { oftable_substitute_rule(rule, op->victim); ofproto_rule_destroy__(rule); + op->rule = NULL; } break; |