DragonFlyBSD Kernel Audit
DF-0207 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/tty_subr.c b/sys/kern/tty_subr.c
--- a/sys/kern/tty_subr.c
+++ b/sys/kern/tty_subr.c
@@ -49,6 +49,7 @@
 clist_alloc_cblocks(struct clist *cl, int ccmax)
 {
 	short *data;
+	short *odata;
 	int count;
 	int n;
 
@@ -60,6 +61,7 @@
 	}
 	data = kmalloc(ccmax * sizeof(*data), M_TTYS, M_INTWAIT|M_ZERO);
 	/* NOTE: cl fields may now be different due to blocking */
+	odata = cl->c_data;
 
 	count = cl->c_cc;
 	if (cl->c_cc) {
@@ -78,6 +80,8 @@
 	cl->c_ccmax = ccmax;
 	cl->c_cchead = 0;
 	cl->c_data = data;
+	if (odata)			/* DF-0207: free the old buffer */
+		kfree(odata, M_TTYS);
 }
 
 /*