Skip to content

Commit 75b26e6

Browse files
simonkelleyDL6ER
authored andcommitted
Fix crash when reloading DHCP config on SIGHUP.
Confusion in the code to free old DHCP configuration when it's being reloaded causes invalid pointers to be followed and a crash. https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q4/017764.html has a more complete explanation of the problem. Signed-off-by: DL6ER <[email protected]>
1 parent 31f28bc commit 75b26e6

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

src/dnsmasq/option.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1339,7 +1339,7 @@ static void dhcp_netid_free(struct dhcp_netid *nid)
13391339

13401340
/* Parse one or more tag:s before parameters.
13411341
* Moves arg to the end of tags. */
1342-
static struct dhcp_netid * dhcp_tags(char **arg)
1342+
static struct dhcp_netid *dhcp_tags(char **arg)
13431343
{
13441344
struct dhcp_netid *id = NULL;
13451345

@@ -1363,7 +1363,13 @@ static void dhcp_netid_list_free(struct dhcp_netid_list *netid)
13631363
{
13641364
struct dhcp_netid_list *tmplist = netid;
13651365
netid = netid->next;
1366-
dhcp_netid_free(tmplist->list);
1366+
/* Note: don't use dhcp_netid_free() here, since that
1367+
frees a list linked on netid->next. Where a netid_list
1368+
is used that's because the the ->next pointers in the
1369+
netids are being used to temporarily construct
1370+
a list of valid tags. */
1371+
free(tmplist->list->net);
1372+
free(tmplist->list);
13671373
free(tmplist);
13681374
}
13691375
}

0 commit comments

Comments
 (0)