dpif-netdev: Fix use-after-free in dpif_netdev_recv.
authorBen Pfaff <blp@nicira.com>
Sat, 9 Jun 2012 15:55:29 +0000 (11:55 -0400)
committerBen Pfaff <blp@nicira.com>
Sun, 10 Jun 2012 04:07:46 +0000 (21:07 -0700)
Found by valgrind.

Signed-off-by: Ben Pfaff <blp@nicira.com>
lib/dpif-netdev.c

index fb0a863e3e3378177f6ad2b892d274faf7260945..cade79efee836361086e2ea9884d253671229431 100644 (file)
@@ -956,7 +956,7 @@ dpif_netdev_recv(struct dpif *dpif, struct dpif_upcall *upcall,
         free(u);
 
         ofpbuf_uninit(buf);
-        *buf = *u->packet;
+        *buf = *upcall->packet;
 
         return 0;
     } else {