Transactions D24332 Change Details

Change Details

Old
New
Diff

Peter and I came up with a test case that triggers a use-after-free: uipc_ready() frees the mbufs after the connection is dropped, and then unp_dispose() crashes while scanning buffered data.

Peter and I came up with a test case that triggers a use-after-free: uipc_ready() frees the mbufs after the connection is dropped, and then unp_dispose() crashes while scanning buffered data.