mirror of
http://thekelleys.org.uk/git/dnsmasq.git
synced 2026-10-18 11:09:36 +00:00
Simon Kelley
77d4749a5e
Full credit to Jerry Tom <goonsomeway@gmail.com> for finding this. When DNSSEC validation falls back to TCP (via a forked child process), the parent uses a uid-based check to detect whether a frec has been freed and reused before the child returns. It doesn't, however check for the more likely scenario which is that the frec has simply been freed via the timeout path in get_new_frec(). This leads to a use-after-free on an already freed frec.