It is possible that SA was removed while processing packed, in which case it changed to the DEAD state and it index removed from the tree. Dereferencing sav->sah then touches freed memory.
Details
Details
- Reviewers
ae jhb - Commits
- rG1a56620b7958: ipsec esp: avoid dereferencing freed secasindex
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Not Applicable - Unit
Tests Not Applicable