Skip to content

[Bug] Didn't use pcap_freecode to free the bpf_program struct generated by pcap_compile #572

@lvtao-sec

Description

@lvtao-sec

Describe the bug
The code of current version 1150736 at the following locations didn't free the bpf_pgrogram structure generated by pcap_compile:

src/tcpprep.c:139:        if (pcap_compile(options->pcap, &options->bpf.program, options->bpf.filter,
src/tcpliveplay.c:662:    if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
src/tcpliveplay.c:697:    if (pcap_compile(handle, &fp, filter_exp, 0, net) == -1) {
src/bridge.c:209:        if (pcap_compile(options->pcap1, &options->bpf.program, options->bpf.filter, options->bpf.optimize, 0) != 0) {
src/bridge.c:220:            if (pcap_compile(options->pcap2, &options->bpf.program, options->bpf.filter, options->bpf.optimize, 0) != 0) {

The document of libpcap said : pcap_freecode() is used to free up allocated memory pointed to by a bpf_program struct generated by pcap_compile(3PCAP) when that BPF program is no longer needed, for example after it has been made the filter program for a pcap structure by a call to pcap_setfilter(3PCAP)

So patch those code with pcap_freecode API.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions