Thu Nov 17 14:46:31 2011 UTC ()

fixed some crashes in LIST_FOREACH where current element could be removed during the loop


(vanhu)

diff -r1.39 -r1.39.2.1 src/crypto/dist/ipsec-tools/src/racoon/handler.c

--- src/crypto/dist/ipsec-tools/src/racoon/handler.c 2011/03/14 17:18:12	1.39
+++ src/crypto/dist/ipsec-tools/src/racoon/handler.c 2011/11/17 14:46:31	1.39.2.1

 @@ -1,14 +1,14 @@
-/*	$NetBSD: handler.c,v 1.39 2011/03/14 17:18:12 tteras Exp $	*/
+/*	$NetBSD: handler.c,v 1.39.2.1 2011/11/17 14:46:31 vanhu Exp $	*/
 /* Id: handler.c,v 1.28 2006/05/26 12:17:29 manubsd Exp */
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
 @@ -601,29 +601,31 @@ getph2bymsgid(iph1, msgid)
  * but the source and destination addresses used for
  * for SA negotiation (best example is tunnel mode SA
  * where src and dst are the endpoints). There is at most
  * a unique match because racoon does not support bundles
  * which makes that there is at most a single established
  * SA for a given spid. One could say that src and dst
  * are in fact useless ...
  */
 struct ph2handle *
 getph2byid(src, dst, spid)
 	struct sockaddr *src, *dst;
 	u_int32_t spid;
+{
-	struct ph2handle *p;
+	struct ph2handle *p, *next;
 	for (p = LIST_FIRST(&ph2tree); p; p = next) {
 		next = LIST_NEXT(p, chain);
 	LIST_FOREACH(p, &ph2tree, chain) {
 		if (spid == p->spid &&
 		    cmpsaddr(src, p->src) <= CMPSADDR_WILDPORT_MATCH &&
 		    cmpsaddr(dst, p->dst) <= CMPSADDR_WILDPORT_MATCH){
 			/* Sanity check to detect zombie handlers
 			 * XXX Sould be done "somewhere" more interesting,
 			 * because we have lots of getph2byxxxx(), but this one
 			 * is called by pk_recvacquire(), so is the most important.
 			 */
 			if(p->status < PHASE2ST_ESTABLISHED &&
 			   p->retry_counter == 0
 			   && p->sce.func == NULL && p->scr.func == NULL) {
 				plog(LLV_DEBUG, LOCATION, NULL,
 					 "Zombie ph2 found, expiring it\n");
 @@ -975,29 +977,31 @@ inscontacted(remote)
 		racoon_free(new);
 		return -1;
+	}
 	LIST_INSERT_HEAD(&ctdtree, new, chain);
 	return 0;
+}
 void
 remcontacted(remote)
 	struct sockaddr *remote;
+{
-	struct contacted *p;
+	struct contacted *p, *next;
 	for (p = LIST_FIRST(&ctdtree); p; p = next) {
 		next = LIST_NEXT(p, chain);
 	LIST_FOREACH(p, &ctdtree, chain) {
 		if (cmpsaddr(remote, p->remote) <= CMPSADDR_WILDPORT_MATCH) {
 			LIST_REMOVE(p, chain);
 			racoon_free(p->remote);
 			racoon_free(p);
 			break;
+		}
+	}
+}
 void
 initctdtree()
+{
 	LIST_INIT(&ctdtree);
 @@ -1545,30 +1549,32 @@ getph1bylogin(login)
 		if (p->mode_cfg == NULL)
 			continue;
 		if (strncmp(p->mode_cfg->login, login, LOGINLEN) == 0)
 			return p;
+	}
 	return NULL;
+}
 int
 purgeph1bylogin(login)
 	char *login;
+{
-	struct ph1handle *p;
+	struct ph1handle *p, *next;
 	int found = 0;
-	LIST_FOREACH(p, &ph1tree, chain) {
+	for (p = LIST_FIRST(&ph1tree); p; p = next) {
 		next = LIST_NEXT(p, chain);
 		if (p->mode_cfg == NULL)
 			continue;
 		if (strncmp(p->mode_cfg->login, login, LOGINLEN) == 0) {
 			if (p->status >= PHASE1ST_EXPIRED)
 				continue;
 			if (p->status >= PHASE1ST_ESTABLISHED)
 				isakmp_info_send_d1(p);
 			purge_remote(p);
 			found++;
+		}
+	}