From bcb1c37c87abd142ea677d8965cab8d5b0fc87c6 Mon Sep 17 00:00:00 2001 From: Evgeny Date: Thu, 23 Apr 2026 02:09:09 +0300 Subject: [PATCH] Fix two more UAF in route_bgp: move DEBUG_INFO before etcp_send - route_bgp_send_nat_info: moved ip_to_str(pkt->nat_ip) log before etcp_send - route_bgp_send_nat_check_req: moved ip_to_str(pkt->interface_ip) log before etcp_send Both were reading from pkt memory that could be freed by etcp_send callback. --- src/route_bgp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/route_bgp.c b/src/route_bgp.c index 778b6e3f..6af2e93d 100644 --- a/src/route_bgp.c +++ b/src/route_bgp.c @@ -1064,11 +1064,11 @@ void route_bgp_send_nat_info(struct ETCP_CONN* conn, uint8_t socket_id, uint32_t } e->dgram = (uint8_t*)pkt; e->len = sizeof(struct BGP_NAT_INFO); - etcp_send(conn, e); DEBUG_INFO(DEBUG_CATEGORY_BGP, "route_bgp_send_nat_info to %s: socket_id=%u type=%s ip=%s port=%u", conn->log_name, socket_id, nat_type == NAT_TYPE_OPEN ? "OPEN" : "RESTRICTED", ip_to_str(pkt->nat_ip, AF_INET).str, (unsigned)nat_port); + etcp_send(conn, e); } void route_bgp_send_nat_check_req(struct ETCP_CONN* conn, uint8_t socket_id) { @@ -1099,11 +1099,11 @@ void route_bgp_send_nat_check_req(struct ETCP_CONN* conn, uint8_t socket_id) { } e->dgram = (uint8_t*)pkt; e->len = sizeof(struct BGP_NAT_CHECK_REQ); - etcp_send(conn, e); DEBUG_INFO(DEBUG_CATEGORY_BGP, "route_bgp_send_nat_check_req to %s: socket_id=%u interface=%s:%u", conn->log_name, socket_id, ip_to_str(&pkt->interface_ip, AF_INET).str, (unsigned)ntohs(pkt->interface_port)); + etcp_send(conn, e); } void route_bgp_request_nat_check_all(struct ROUTE_BGP* bgp) {