public inbox for glibc-cvs@sourceware.org help / color / mirror / Atom feed
From: Tulio Magno Quites Machado Filho <tuliom@sourceware.org> To: glibc-cvs@sourceware.org Subject: [glibc/ibm/2.32/master] nscd: Fix double free in netgroupcache [BZ #27462] Date: Tue, 27 Apr 2021 13:18:50 +0000 (GMT) [thread overview] Message-ID: <20210427131850.C9D76398B848@sourceware.org> (raw) https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=1d4526569162e6c8f0789eb077492730b0756b3b commit 1d4526569162e6c8f0789eb077492730b0756b3b Author: DJ Delorie <dj@redhat.com> Date: Thu Feb 25 16:08:21 2021 -0500 nscd: Fix double free in netgroupcache [BZ #27462] In commit 745664bd798ec8fd50438605948eea594179fba1 a use-after-free was fixed, but this led to an occasional double-free. This patch tracks the "live" allocation better. Tested manually by a third party. Related: RHBZ 1927877 Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org> Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit dca565886b5e8bd7966e15f0ca42ee5cff686673) Diff: --- nscd/netgroupcache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nscd/netgroupcache.c b/nscd/netgroupcache.c index 88c69d1e9c..381aa721ef 100644 --- a/nscd/netgroupcache.c +++ b/nscd/netgroupcache.c @@ -248,7 +248,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, : NULL); ndomain = (ndomain ? newbuf + ndomaindiff : NULL); - buffer = newbuf; + *tofreep = buffer = newbuf; } nhost = memcpy (buffer + bufused, @@ -319,7 +319,7 @@ addgetnetgrentX (struct database_dyn *db, int fd, request_header *req, else if (status == NSS_STATUS_TRYAGAIN && e == ERANGE) { buflen *= 2; - buffer = xrealloc (buffer, buflen); + *tofreep = buffer = xrealloc (buffer, buflen); } else if (status == NSS_STATUS_RETURN || status == NSS_STATUS_NOTFOUND
reply other threads:[~2021-04-27 13:18 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210427131850.C9D76398B848@sourceware.org \ --to=tuliom@sourceware.org \ --cc=glibc-cvs@sourceware.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).