DragonFlyBSD Kernel Audit
DF-0746 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/netbt/l2cap_misc.c b/sys/netbt/l2cap_misc.c
--- a/sys/netbt/l2cap_misc.c
+++ b/sys/netbt/l2cap_misc.c
@@ -185,11 +185,13 @@
 {
 	struct l2cap_req *req = arg;
 	struct l2cap_channel *chan;
+	uint8_t id;			/* DF-0746: capture lr_id before free */
 
 	chan = req->lr_chan;
+	id = req->lr_id;
 	l2cap_request_free(req);
 
-	DPRINTF("cid %d, ident %d\n", (chan ? chan->lc_lcid : 0), req->lr_id);
+	DPRINTF("cid %d, ident %d\n", (chan ? chan->lc_lcid : 0), id);
 
 	if (chan && chan->lc_state != L2CAP_CLOSED)
 		l2cap_close(chan, ETIMEDOUT);