public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug build/28521] New: likely benign use-after-free instances in Glibc
@ 2021-10-31 19:05 msebor at gmail dot com
2021-11-12 10:54 ` [Bug build/28521] " fweimer at redhat dot com
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: msebor at gmail dot com @ 2021-10-31 19:05 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=28521
Bug ID: 28521
Summary: likely benign use-after-free instances in Glibc
Product: glibc
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: build
Assignee: unassigned at sourceware dot org
Reporter: msebor at gmail dot com
CC: carlos at redhat dot com
Target Milestone: ---
Testing a new GCC warning to detect uses of pointers invalidated by a
deallocation call exposed a few instances in Glibc. This is to make record of
these ahead of submitting the new GCC warning for review. As best I can tell
these are all true positives (using an indeterminate pointer in any expression,
including but not limited to dereferencing it, is undefined), although the uses
are in all likelihood benign.
localealias.c: In function ‘read_alias_file’:
localealias.c:335:56: warning: pointer may be used after ‘realloc’
[-Wuse-after-free=]
335 | map[i].alias += new_pool - string_space;
| ~~~~~~~~~^~~~~~~~~~~~~~
localealias.c:325:49: note: call to ‘realloc’ here
325 | char *new_pool = (char *) realloc (string_space,
new_size);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
localealias.c:329:26: warning: pointer may be used after ‘realloc’
[-Wuse-after-free=]
329 | if (__builtin_expect (string_space != new_pool,
0))
| ^
localealias.c:325:49: note: call to ‘realloc’ here
325 | char *new_pool = (char *) realloc (string_space,
new_size);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
localealias.c:335:56: warning: pointer may be used after ‘realloc’
[-Wuse-after-free=]
335 | map[i].alias += new_pool - string_space;
| ~~~~~~~~~^~~~~~~~~~~~~~
localealias.c:325:49: note: call to ‘realloc’ here
325 | char *new_pool = (char *) realloc (string_space,
new_size);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
localealias.c:329:26: warning: pointer may be used after ‘realloc’
[-Wuse-after-free=]
329 | if (__builtin_expect (string_space != new_pool,
0))
| ^
localealias.c:325:49: note: call to ‘realloc’ here
325 | char *new_pool = (char *) realloc (string_space,
new_size);
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
setenv.c: In function ‘__add_to_environ’:
setenv.c:162:10: warning: pointer may be used after ‘realloc’
[-Wuse-after-free=]
162 | if (__environ != last_environ)
| ^
setenv.c:154:31: note: call to ‘realloc’ here
154 | new_environ = (char **) realloc (last_environ,
| ^~~~~~~~~~~~~~~~~~~~~~
155 | (size + 2) * sizeof (char *));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
setenv.c:162:10: warning: pointer may be used after ‘realloc’
[-Wuse-after-free=]
162 | if (__environ != last_environ)
| ^
setenv.c:154:31: note: call to ‘realloc’ here
154 | new_environ = (char **) realloc (last_environ,
| ^~~~~~~~~~~~~~~~~~~~~~
155 | (size + 2) * sizeof (char *));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ldconfig.c: In function ‘manual_link’:
ldconfig.c:739:6: warning: pointer ‘path’ may be used after ‘free’
[-Wuse-after-free=]
739 | if (path != real_path)
| ^
ldconfig.c:738:3: note: call to ‘free’ here
738 | free (path);
| ^~~~~~~~~~~
ldconfig.c:739:6: warning: pointer ‘path’ may be used after ‘free’
[-Wuse-after-free=]
739 | if (path != real_path)
| ^
ldconfig.c:738:3: note: call to ‘free’ here
738 | free (path);
| ^~~~~~~~~~~
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-01-12 17:16 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-10-31 19:05 [Bug build/28521] New: likely benign use-after-free instances in Glibc msebor at gmail dot com
2021-11-12 10:54 ` [Bug build/28521] " fweimer at redhat dot com
2021-11-12 15:50 ` msebor at gmail dot com
2022-01-12 17:16 ` msebor at gmail dot com
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).