From 0e77fc66bceb9832da82a56a4c1040fe49f8d805 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 29 May 2020 16:56:09 +0900 Subject: [PATCH] network: fix double free in macsec_receive_channel_free() Fixes #15941. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=22547 --- src/network/netdev/macsec.c | 2 +- test/fuzz/fuzz-netdev-parser/oss-fuzz-22547 | 10 ++++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 test/fuzz/fuzz-netdev-parser/oss-fuzz-22547 diff --git a/src/network/netdev/macsec.c b/src/network/netdev/macsec.c index 3542f9652a..8f7559e9ae 100644 --- a/src/network/netdev/macsec.c +++ b/src/network/netdev/macsec.c @@ -102,7 +102,7 @@ static void macsec_receive_channel_free(ReceiveChannel *c) { if (c->macsec) { if (c->sci.as_uint64 > 0) - ordered_hashmap_remove(c->macsec->receive_channels, &c->sci.as_uint64); + ordered_hashmap_remove_value(c->macsec->receive_channels, &c->sci.as_uint64, c); if (c->section) ordered_hashmap_remove(c->macsec->receive_channels_by_section, c->section); diff --git a/test/fuzz/fuzz-netdev-parser/oss-fuzz-22547 b/test/fuzz/fuzz-netdev-parser/oss-fuzz-22547 new file mode 100644 index 0000000000..ca55a33ae9 --- /dev/null +++ b/test/fuzz/fuzz-netdev-parser/oss-fuzz-22547 @@ -0,0 +1,10 @@ +[NetDev] +Name=o +Kind=macsec + +[MACsecReceiveChannel] +MACAddress=12.0.4 +Port=913 +[MACsecReceiveChannel] +MACAddress=12.0.4 +Port=913 -- 2.23.0