Bug #4018: Napatech: Double release of packet possible in certain error cases. - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #4018

closed

Napatech: Double release of packet possible in certain error cases.

Added by Jeff Lucovsky about 4 years ago. Updated about 4 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Phil Young

Target version:

6.0.1

Affected Versions:

5.0.3, 6.0.0rc1

Effort:

Difficulty:

Label:

Needs backport to 5.0

Description

        p->ReleasePacket = NapatechReleasePacket;
        p->ntpv.nt_packet_buf = packet_buffer;
        p->ntpv.stream_id = ntv->stream_id;
        p->datalink = LINKTYPE_ETHERNET;

        if (unlikely(PacketSetData(p, (uint8_t *)NT_NET_GET_PKT_L2_PTR(packet_buffer), NT_NET_GET_PKT_WIRE_LENGTH(packet_buffer)))) {
            TmqhOutputPacketpool(ntv->tv, p);
            NT_NetRxRelease(ntv->rx_stream, packet_buffer);
            SCReturnInt(TM_ECODE_FAILED);
         }

When "PacketSetData" fails, the packet buffer will be released twice
- TmqhOutputPacketpool calls "p->ReleasePacket" which calls "NT_NetRxRelease"
- Direct call to NT_NetRxRelease

Related issues 1 (0 open — 1 closed)