diff options
| author | khedor <khedor@gmail.com> | 2026-05-22 20:14:57 +0300 |
|---|---|---|
| committer | Denys Fedoryshchenko <denys.f@collabora.com> | 2026-05-23 11:41:36 +0300 |
| commit | 4823556fbbadcd5205175d423ebca627dc317843 (patch) | |
| tree | fbb82d07046f499ae272294150c0b41658f126b4 | |
| parent | 22c61e8e2e16ebe8e9576fe46487e3614982e8ac (diff) | |
| download | accel-ppp-4823556fbbadcd5205175d423ebca627dc317843.tar.gz accel-ppp-4823556fbbadcd5205175d423ebca627dc317843.zip | |
pppoe/disc: fix init_net allocation size
In init_net(), the buffer for struct disc_net was sized as
n = _malloc(sizeof(*net) + (HASH_BITS + 1) * sizeof(struct tree));
but 'net' is the const struct ap_net * argument, not the disc_net being
allocated. sizeof(*net) is therefore sizeof(struct ap_net), which is
substantially smaller than sizeof(struct disc_net). Every field of *n
written past the ap_net-sized prefix (ctx, hnd, net, refs, etc.) lands
in unallocated heap memory.
Use sizeof(*n) so the allocation matches the actual destination type.
Signed-off-by: khedor <khedor@gmail.com>
| -rw-r--r-- | accel-pppd/ctrl/pppoe/disc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/accel-pppd/ctrl/pppoe/disc.c b/accel-pppd/ctrl/pppoe/disc.c index e673a97a..25d4be26 100644 --- a/accel-pppd/ctrl/pppoe/disc.c +++ b/accel-pppd/ctrl/pppoe/disc.c @@ -77,7 +77,7 @@ static struct disc_net *init_net(const struct ap_net *net) fcntl(sock, F_SETFD, FD_CLOEXEC); net->set_nonblocking(sock, 1); - n = _malloc(sizeof(*net) + (HASH_BITS + 1) * sizeof(struct tree)); + n = _malloc(sizeof(*n) + (HASH_BITS + 1) * sizeof(struct tree)); tree = n->tree; for (i = 0; i <= HASH_BITS; i++) { |