DragonFlyBSD Kernel Audit
DF-2556 / fix.diff
← back to finding ↓ download raw
diff --git a/sys/kern/tty_subr.c b/sys/kern/tty_subr.c
@@ -77,6 +77,14 @@
 	cl->c_cc = count;
 	cl->c_ccmax = ccmax;
 	cl->c_cchead = 0;
+	/*
+	 * Free the PREVIOUS c_data buffer before dropping our only reference to
+	 * it.  Without this every reallocation to a different non-zero size leaks
+	 * one M_TTYS allocation (DF-2556).  Guard the first allocation, where
+	 * c_data is still NULL.
+	 */
+	if (cl->c_data != NULL)
+		kfree(cl->c_data, M_TTYS);
 	cl->c_data = data;
 }