From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2012) id 7CA483858C5F; Tue, 6 Jun 2023 19:18:19 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 7CA483858C5F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1686079099; bh=rwCjtQAitiAQKeisixcr+bFAHYNPLSu40cSxjmHH2YQ=; h=From:To:Subject:Date:From; b=IfTX51r/ATd6Cr6swkPmDicsRC0pB05mgFtAHeLIsZCX1sM+Ep/IJeUAVxSGICCNT Mgzka3oiGixbR/ymLjgYg0nGmdHCPi7NaoHQ1a0KLF/fVtKeINw3MFmbgk24EJWbdi 0GnW7txQOaoEO8cTfuJFhK9x7J9NEjNVtwIHmNW4= Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Arjun Shankar To: glibc-cvs@sourceware.org Subject: [glibc] time: Fix use-after-free in getdate X-Act-Checkin: glibc X-Git-Author: Arjun Shankar X-Git-Refname: refs/heads/master X-Git-Oldrev: 200ae471b65354eed6f1bc7658f898f2f380951a X-Git-Newrev: 85e6d8b4175fcb195011a0a1bad37d6f3b2355db Message-Id: <20230606191819.7CA483858C5F@sourceware.org> Date: Tue, 6 Jun 2023 19:18:19 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=85e6d8b4175fcb195011a0a1bad37d6f3b2355db commit 85e6d8b4175fcb195011a0a1bad37d6f3b2355db Author: Arjun Shankar Date: Tue Jun 6 19:20:31 2023 +0200 time: Fix use-after-free in getdate getdate would free the buffer pointed to by the result of its call to strptime, then reference the same buffer later on -- leading to a use-after-free. This commit fixes that. Reported-by: Martin Coufal Reviewed-by: Adhemerval Zanella Diff: --- time/getdate.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/time/getdate.c b/time/getdate.c index 1dcbd77188..ca058394a3 100644 --- a/time/getdate.c +++ b/time/getdate.c @@ -114,6 +114,7 @@ __getdate_r (const char *string, struct tm *tp) struct tm tm; struct __stat64_t64 st; bool mday_ok = false; + bool found = false; datemsk = getenv ("DATEMSK"); if (datemsk == NULL || *datemsk == '\0') @@ -181,7 +182,7 @@ __getdate_r (const char *string, struct tm *tp) tp->tm_gmtoff = 0; tp->tm_zone = NULL; result = strptime (string, line, tp); - if (result && *result == '\0') + if ((found = (result && *result == '\0'))) break; } while (!__feof_unlocked (fp)); @@ -201,7 +202,7 @@ __getdate_r (const char *string, struct tm *tp) /* Close template file. */ fclose (fp); - if (result == NULL || *result != '\0') + if (!found) return 7; /* Get current time. */